CVE-2025-14600
CriticalCVSS 9.3Summary
vsDesk contains an insecure deserialization vulnerability that allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account.
Risk Assessment
An attacker can gain full control of the vsDesk system, potentially leading to compromise of data confidentiality, integrity, and availability.
Recommendation
Apply the vendor patch (https://vsdesk.ru/). Versions 14.0402 and later include the fix.
Original NVD description (English source)
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.