Which versions of vsDesk are affected by CVE-2025-14601?

vsDesk Task Scheduler component (versions 11.06.02 and earlier) contains an OS command injection vulnerability (CVSS 8.6) allowing authenticated administrators to execute arbitrary operating system…

How to fix or mitigate CVE-2025-14601?

Within 24 hours: inventory all vsDesk deployments, identify installed versions (11.06.02 and earlier priority), and audit administrative account credentials and recent activity logs for anomalies. Within 7 days: implement multi-factor authentication for all vsDesk administrators, enforce principle of least privilege on admin access, enable comprehensive logging of Task Scheduler activity, and deploy network segmentation to isolate vsDesk systems from critical infrastructure. Within 30 days: establish continuous monitoring of Kaspersky and vsDesk vendor advisories for patch availability, conduct penetration testing of administrative access controls, and develop detailed runbooks for immediate patch deployment once vendor releases fixes.

vsDesk CVE-2025-14601

Q: What is the CVSS score of CVE-2025-14601?

CVE-2025-14601 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2025-210747 HIGH

Use of Potentially Dangerous Function (CWE-676)

2026-08-20 Kaspersky

Command Injection Information Disclosure Vsdesk

8.6

CVSS 4.0 · Vendor: Kaspersky

Severity by source

Vendor (Kaspersky) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Admin credentials required (PR:H); network-reachable with no complexity (AV:N/AC:L); no scope change as impact is confined to the vsDesk host (S:U); full C/I/A impact consistent with arbitrary OS command execution.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Kaspersky).

CVSS VectorVendor: Kaspersky

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 20, 2026 - 08:16 vuln.today

CVE Published

Aug 20, 2026 - 07:21 cve.org

HIGH 8.6

DescriptionCVE.org

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise.

Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.

AnalysisAI

OS command injection in vsDesk's Task Scheduler component enables authenticated administrators to execute arbitrary operating system commands on the underlying server due to insufficient input filtering. Affecting at least vsDesk 11.06.02, the flaw - discovered and reported by Kaspersky - can be leveraged to disrupt web server operations, exfiltrate sensitive data, or achieve full server compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires high-privilege authenticated access, which meaningfully constrains opportunistic attack scenarios.

Technical ContextAI

vsDesk is a Russian-market IT service desk and helpdesk platform (CPE: cpe:2.3:a:vsdesk:vsdesk:*:*:*:*:*:*:*:*). The vulnerability resides in the Task Scheduler subsystem, where user-supplied input is passed to a potentially dangerous OS-level function (CWE-676: Use of Potentially Dangerous Function) without adequate sanitization or escaping. CWE-676 specifically identifies the use of inherently risky functions - such as system(), exec(), popen(), or shell_exec() - in ways that permit injection of attacker-controlled data into the OS command context. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) confirms the vulnerability is reachable over the network with no attack complexity or additional attack requirements beyond administrative credentials, and the Kaspersky advisory (KLSA-00343) provides the authoritative technical disclosure.

RemediationAI

Vendor-released patch: version 14.0101. Organizations running vsDesk should upgrade to version 14.0101 or later, available from the vendor at https://vsdesk.ru/. The version jump from 11.06.02 to 14.0101 is significant; verify compatibility with existing integrations and configurations before upgrading in production. If immediate patching is not feasible, compensating controls should include restricting administrative console access to trusted IP ranges or VPN-only networks, enforcing multi-factor authentication on all administrative accounts to raise the bar for credential compromise, and auditing Task Scheduler configurations for any existing unauthorized or anomalous scheduled tasks that could indicate prior exploitation. Review web server process privileges and consider running the vsDesk service under a least-privilege OS account to limit the blast radius of command injection if it occurs. The Kaspersky advisory (KLSA-00343) should be consulted for any additional vendor-specific guidance.