CVE-2025-14600criticalCWE-305

CVE-2025-14600: falha crítica em vsDesk

Admin Account Takeover via Path Traversal in vsDesk

Publicada em

Seguir esta CVE+ Monitorar vsDesk

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.5%
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
vsDesk · vsDesk
CVEs relacionadas — vsDesk

No mesmo produto, das mais perigosas para as menos.

CVE-2025-14601HIGHvsDesk Task Scheduler OS Command InjectionEPSS 1.1%CVE-2026-2334CRITICAL) Missing Server-Side File Extension Validation in vsDeskEPSS 0.7%CVE-2025-14602MEDIUMWeak File Name Generation in vsDeskEPSS 0.5%CVE-2025-14603HIGHUse of user input in raw SQL queries in vsDesk leading to blind SQL injectionEPSS 0.4%