CVE-2025-10539

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://desktime.com/download	Product
https://r.sec-consult.com/desktime	Third Party Advisory
http://seclists.org/fulldisclosure/2026/Apr/20	Exploit Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2026/Apr/21	Exploit Mailing List Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:draugiemgroup:desktime_time_tracking:*:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Debido a una validación incorrecta de certificados TLS en la aplicación DeskTime Time Tracking anterior a la versión 1.3.674, los atacantes que pueden posicionarse en la ruta de red entre el cliente y los servidores de actualización de DeskTime pueden devolver un ejecutable malicioso en respuesta a una solicitud de actualización. Esto permite al atacante lograr la ejecución remota de código a nivel de usuario en el cliente afectado.

Information

Published : 2026-04-28 09:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-10539

Mitre link : CVE-2025-10539

CVE.ORG link : CVE-2025-10539

JSON object : View

Products Affected

draugiemgroup

desktime_time_tracking

CWE

CWE-295

Improper Certificate Validation

CWE-296

Improper Following of a Certificate's Chain of Trust

CWE-494

Download of Code Without Integrity Check

{"id": "CVE-2025-10539", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10539", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-28T14:09:20.701327Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "affected": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "affectedData": [{"vendor": "DeskTime", "product": "DeskTime Time Tracking App", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.674", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-28T09:16:16.187", "references": [{"url": "https://desktime.com/download", "tags": ["Product"], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://r.sec-consult.com/desktime", "tags": ["Third Party Advisory"], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "http://seclists.org/fulldisclosure/2026/Apr/20", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2026/Apr/21", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-296"}, {"lang": "en", "value": "CWE-494"}]}], "descriptions": [{"lang": "en", "value": "Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client."}, {"lang": "es", "value": "Debido a una validaci\u00f3n incorrecta de certificados TLS en la aplicaci\u00f3n DeskTime Time Tracking anterior a la versi\u00f3n 1.3.674, los atacantes que pueden posicionarse en la ruta de red entre el cliente y los servidores de actualizaci\u00f3n de DeskTime pueden devolver un ejecutable malicioso en respuesta a una solicitud de actualizaci\u00f3n. Esto permite al atacante lograr la ejecuci\u00f3n remota de c\u00f3digo a nivel de usuario en el cliente afectado."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:draugiemgroup:desktime_time_tracking:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D59E9743-3F8A-46EB-8AAC-F684723EDD63", "versionEndExcluding": "1.3.674"}], "operator": "OR"}]}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}