VulnerabilityDeferred

CVE-2025-14601

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering.

HIGH 8.6EPSS 0.80%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.80%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

CVSS 4.0: 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.80% probability · 55th percentile
CISA KEV: Not listed
Weakness: CWE-676
Source: vulnerability@kaspersky.com

References

https://github.com/klsecservices/Advisories/blob/master/KLSA-00343-vsDesk-Task-Scheduler-OS-Command-Injection.md

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.