Weak File Name Generation in vsDesk
Priority LOW 24CWE-340Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00465 40th percentileScored 2026-11-07
Fix Fixed vsDesk (vsDesk): 14.0101
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA vsDesk (vsDesk) Fixed in 14.0101
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14602
- 2026-10-03 Alias added: GHSA-2vv3-69qg-3hgr
References
More vsDesk vulnerabilities
- TI-2025-13340 Admin Account Takeover via Path Traversal in vsDesk CVSS 4.0CRITICAL 9.3
- TI-2026-01974 ) Missing Server-Side File Extension Validation in vsDesk CVSS 4.0CRITICAL 9.4
- TI-2025-13343 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection CVSS 4.0HIGH 8.8
- TI-2025-13341 vsDesk Task Scheduler OS Command Injection CVSS 4.0HIGH 8.6
Sources
- CVE-2025-14602 · CVE Program
- CVE-2025-14602 · NVD
- FIRST EPSS
- GHSA-2vv3-69qg-3hgr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences