Security readout for executives and security teams
Plain-English summary
vsDesk may assign uploaded files names derived predictably from request timestamps. A low-privileged remote attacker could guess those names and access uploaded content, potentially exposing sensitive information or enabling follow-on attacks. The supplied record rates this medium severity, with limited confidentiality impact.
Executive priority
Prioritize remediation for externally reachable deployments handling confidential uploads. Treat this as a moderate, near-term patching item rather than an emergency, unless investigation finds sensitive-file exposure or suspicious access patterns.
Technical view
CVE-2025-14602 is a predictable filename weakness classified as CWE-340 and CWE-377. The CVSS 4.0 score is 5.3, reflecting network reachability, low complexity, low privileges, no user interaction, and limited confidentiality impact. The supplied data says 14.0101 and later are patched, but also lists 14.0101 as affected.
Likely exposure
Exposure is most likely where vsDesk permits low-privileged users to upload files and those files can be retrieved remotely by generated name. The supplied bundle identifies version 11.06.02 but contains conflicting information about whether 14.0101 is affected or fixed.
Exploitation context
The filename can reportedly be guessed or brute-forced within a short timestamp window, allowing unauthorized file discovery. The supplied sources provide no evidence of active exploitation, and the CVE is not listed as KEV in the bundle.
Researcher notes
The core issue is insufficient unpredictability in server-generated upload names. CVSS indicates privileges are required and confidentiality impact is limited. Exact affected-version boundaries require clarification: the bundle says 14.0101 and later are patched while its affected list includes 14.0101. No public exploitation evidence is supplied.
Mitigation direction
- Apply the vendor patch and move to a vendor-confirmed fixed release.
- Confirm 14.0101 status with the vendor because the supplied version data conflicts.
- Restrict uploaded-file retrieval to explicitly authorized users where operationally possible.
- Limit upload privileges and monitor suspicious repeated requests for generated files.
Validation and detection
- Inventory all vsDesk deployments and record their precise versions and builds.
- Obtain vendor confirmation that each deployed release contains the filename-generation patch.
- Verify patched systems no longer generate predictably timestamp-based upload names.
- Review access logs for repeated file requests clustered around upload timestamps.
- Confirm uploaded files require appropriate authorization rather than filename knowledge alone.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-340: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-377: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-14602 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N——KasperskyVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/klsecservices/Advisories/blob/master/KLSA-00294-Weak-File-Name-Generation-in-vsDesk.mdCVE reference, Kaspersky
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Generation of Predictable Numbers or Identifiers
Generation of Predictable Numbers or Identifiers represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Insecure Temporary File
Insecure Temporary File represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.