CVE-2025-10539

4.8 MEDIUM

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselve...

Published: 2026-04-28 · Last updated: 2026-05-18

Severity and scoring

CVSS: 4.8 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE: CWE-295, CWE-296, CWE-494

Affected products

Vendor	Product
draugiemgroup	desktime_time_tracking

Description

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2025-10539
[Other]https://desktime.com/download
[Other]https://r.sec-consult.com/desktime
[Exploit reference]http://seclists.org/fulldisclosure/2026/Apr/20
[Exploit reference]http://seclists.org/fulldisclosure/2026/Apr/21
[Other]https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/

Related CVEs

Same CWE

CVE-2026-53475 — A flaw was found in assisted-migration-agent (9.3 CRITICAL)
CVE-2026-9758 — Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered tru... (7.3 HIGH)
CVE-2026-24066 — Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes ... (8.4 HIGH)
CVE-2026-41714 — Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(... (4.0 MEDIUM)
CVE-2026-42769 — Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (... (5.3 MEDIUM)