CVEvulnerability
CVE-2025-10539
4.8 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-04-28
- Last modified
- 2026-10-07
- Assigner
- 551230f0-3615-47bd-b7cc-93e92e730bbf
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 4.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-295, CWE-296, CWE-494
Description
Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.
Affected configurations
• draugiemgroup desktime time tracking (< 1.3.674)
Related
References
- https://desktime.com/download Product
- https://r.sec-consult.com/desktime Third Party Advisory
- http://seclists.org/fulldisclosure/2026/Apr/20 Exploit, Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2026/Apr/21 Exploit, Mailing List, Third Party Advisory
- https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/ Third Party Advisory