CVE-2025-14600: Admin Account Takeover via Path Traversal in vsDesk
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vsDeskto a version that resolves this vulnerability.Fixed in 14.0402 - Compensating control
If upgrading is not immediately possible, restrict network access so that vsDesk systems cannot reach arbitrary outbound LDAP servers (allow-list only the intended LDAP server addresses/ports).
- Operational
If an unauthorized administrative account may have been provisioned, review vsDesk administrative users and remove/disable any unexpected accounts after applying the patch/upgrade.
Event History
Frequently Asked Questions
Which vsDesk deployments need to be remediated?
Versions earlier than 14.0402 are affected based on the available information. Versions 14.0402 and later include the vendor patch.
What access does an attacker need to exploit this issue?
The issue is described as remotely exploitable. The available information does not state that prior authentication or local access is required.
What is the likely impact of successful exploitation?
An attacker can manipulate application configuration data to make vsDesk authenticate to an arbitrary LDAP server and create a new administrative account. This results in unauthorized administrative access.