CVE-2025-10539

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://desktime.com/download	Product
https://r.sec-consult.com/desktime	Third Party Advisory
http://seclists.org/fulldisclosure/2026/Apr/20	Exploit Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2026/Apr/21	Exploit Mailing List Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:draugiemgroup:desktime_time_tracking:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-28 09:16

Updated : 2026-06-17 08:28

NVD link : CVE-2025-10539

Mitre link : CVE-2025-10539

CVE.ORG link : CVE-2025-10539

JSON object : View

Products Affected

draugiemgroup

desktime_time_tracking

CWE

CWE-295

Improper Certificate Validation

CWE-296

Improper Following of a Certificate's Chain of Trust

CWE-494

Download of Code Without Integrity Check

{"id": "CVE-2025-10539", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10539", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-28T14:09:20.701327Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "affected": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "affectedData": [{"vendor": "DeskTime", "product": "DeskTime Time Tracking App", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.674", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-28T09:16:16.187", "references": [{"url": "https://desktime.com/download", "tags": ["Product"], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://r.sec-consult.com/desktime", "tags": ["Third Party Advisory"], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "http://seclists.org/fulldisclosure/2026/Apr/20", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2026/Apr/21", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-296"}, {"lang": "en", "value": "CWE-494"}]}], "descriptions": [{"lang": "en", "value": "Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client."}], "lastModified": "2026-06-17T08:28:28.960", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:draugiemgroup:desktime_time_tracking:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D59E9743-3F8A-46EB-8AAC-F684723EDD63", "versionEndExcluding": "1.3.674"}], "operator": "OR"}]}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}