CVE-2025-44015
HighCVSS 8.4Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
A command injection vulnerability has been reported in HybridDesk Station. An attacker with local network access can exploit it to execute arbitrary commands.
Risk Assessment
The flaw enables remote code execution within the local network, potentially leading to device compromise and further lateral movement.
Recommendation
Update HybridDesk Station to version 4.2.18 or later.
Other vulnerabilities in HybridDesk Station
See all- CVE-2026-47786Critical
An OS command injection vulnerability has been reported in HybridDesk Station, which could allow remote attackers to execute arbitrary commands. The vulnerability has been fixed in versions 4.2.23 and 4.3.4 and later.
- CVE-2026-39997High
A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.
Original NVD description (English source)
A command injection vulnerability has been reported to affect HybridDesk Station. If an attacker gains local network access, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.18 and later
Vulnerability data from NVD (NIST) · CISA KEV · EPSS