CVE-2025-14601
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-14601 is a high-severity Use of Potentially Dangerous Function (CWE-676) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 37% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-11.4 — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-210747
Vulnerability Data
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or…
more
potentially achieve full server compromise. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and code analysis directly locate calls to unsafe functions.
detection-method-derived `finds`: edge only, ungraded, per the 2026-08-12 registry amendment. `owner_ruled_grade` records what the owner said and is NOT the stored grade -- this lane stores no extent.
Documented standards and tools can explicitly disallow dangerous functions during development.
Engineering principles can mandate safe APIs and ban dangerous functions at design time.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require avoiding or safely wrapping dangerous functions during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
awareness/education/training on responsibilities and safe practices does not stop a dangerous function from being callable or exploitable if it is still present in code; this is a code-construction defect unaffected by personnel training
A.8.25 mandates secure SDLC practices including secure coding guidelines, developer training, vulnerability prevention/fixing capability, and testing (code scans, penetration tests) that reach dangerous-function use; this stops exploitation in many but not all cases (e.g. legacy code, un-reviewed third-party libs, or incomplete guideline coverage), leaving a bounded remainder.
Secure coding standards explicitly ban or restrict dangerous functions such as strcpy, gets, or system.
Security testing can surface instances of dangerous functions but does not prevent their introduction.