Insecure Deserialization in vsDesk Affects Remote Administrative Access
CVE-2025-14600

9.3CRITICAL

Key Information:

Vendor

Vsdesk

Status
Vsdesk
Vendor
CVE Published:
19 August 2026

What is CVE-2025-14600?

An insecure deserialization vulnerability in vsDesk poses a significant risk, allowing attackers to gain unauthorized administrative access. By manipulating application configuration data, an attacker can redirect the system to authenticate against an arbitrary LDAP server, leading to the provisioning of a new administrative account. It's crucial for users of vsDesk to apply the necessary patches available in versions 14.0402 and later to mitigate this risk.

Affected Version(s)

vsDesk 11.06.02

vsDesk 14.01.01

vsDesk 14.0402

References

https://github.com/klsecservices/Advisories/blob/master/K...
https://vsdesk.ru/news/vyshla-novaya-versiya-140422

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The vulnerability was discovered by Kirill Nikolaev from Kaspersky (https://kaspersky.com)
.