CVE-2025-10539

Description

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

PUBLISHED Reserved 2025-09-16 | Published 2026-04-28 | Updated 2026-04-28 | Assigner SEC-VLab

Problem types

CWE-295 Improper certificate validation

CWE-296 Improper following of a certificate's chain of trust

CWE-494 Download of code without integrity check

Product status

Credits

Daniel Hirschberger, SEC Consult Vulnerability Lab finder

Thorger Jansen, SEC Consult Vulnerability Lab finder

Tobias Niemann, SEC Consult Vulnerability Lab finder

Marius Renner, SEC Consult Vulnerability Lab finder

References

sec-consult.com/...ing-to-rce-in-desktime-time-tracking-app/ exploit

r.sec-consult.com/desktime third-party-advisory

desktime.com/download patch

cve.org (CVE-2025-10539)

nvd.nist.gov (CVE-2025-10539)

Download JSON