CVE-2025-14601: vsDesk Task Scheduler OS Command Injection
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vsDesk Task Schedulerto a version that resolves this vulnerability.Fixed in 14.0101
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Exploitation requires an authenticated vsDesk user with administrative privileges. It is therefore most relevant to deployments where administrator accounts may be compromised, shared, or accessible to untrusted operators.
Which versions are patched?
vsDesk version 14.0101 and later include the vendor patch. Deployments running versions earlier than 14.0101 should be treated as potentially affected based on the available information.
What should be done if patching cannot happen immediately?
Limit and closely protect vsDesk administrative access, since administrative authentication is required for exploitation. Monitor administrative use of the Task Scheduler for suspicious command input or unexpected server activity.