An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating… (CVE-2025-14601)
An OS command injection vulnerability exists in vsDesk that allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. This flaw can be exploited to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise. The vendor has released a patch starting from version 14.0101 to address this issue.
AI Analysis
Technical Summary
CVE-2025-14601 describes an OS command injection vulnerability in the vsDesk application. The vulnerability arises from insufficient input filtering, enabling an authenticated attacker with administrative privileges to execute arbitrary OS commands. Exploitation of this vulnerability could lead to disruption of web server operations, exposure of sensitive information, or full compromise of the server. The vendor has provided a patch beginning with version 14.0101 to remediate this issue.
Potential Impact
Successful exploitation allows an attacker with administrative access to execute arbitrary operating system commands, which can disrupt web server functionality, expose sensitive data, or lead to complete server compromise. This represents a high security risk to affected systems.
Mitigation Recommendations
Apply the vendor-provided patch available starting from vsDesk version 14.0101. Upgrading to version 14.0101 or later will mitigate this vulnerability.
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating… (CVE-2025-14601)
Description
An OS command injection vulnerability exists in vsDesk that allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. This flaw can be exploited to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise. The vendor has released a patch starting from version 14.0101 to address this issue.
CVSS v4.0
Affected software
pkg:github/klsecservices/vsDeskRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-14601 describes an OS command injection vulnerability in the vsDesk application. The vulnerability arises from insufficient input filtering, enabling an authenticated attacker with administrative privileges to execute arbitrary OS commands. Exploitation of this vulnerability could lead to disruption of web server operations, exposure of sensitive information, or full compromise of the server. The vendor has provided a patch beginning with version 14.0101 to remediate this issue.
Potential Impact
Successful exploitation allows an attacker with administrative access to execute arbitrary operating system commands, which can disrupt web server functionality, expose sensitive data, or lead to complete server compromise. This represents a high security risk to affected systems.
Mitigation Recommendations
Apply the vendor-provided patch available starting from vsDesk version 14.0101. Upgrading to version 14.0101 or later will mitigate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mjxg-34vj-37wc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-14601"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a870a53acd9273b49b585e5
Added to database: 08/20/2026, 14:08:19 UTC
Last enriched: 08/20/2026, 14:18:18 UTC
Last updated: 08/20/2026, 18:52:07 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.