VULNERABILITY INTELLIGENCE

CVE-2025-10539

CVSS score4.8 MEDIUM

EPSS probability0.18%

CISA KEVNot currently listed

Published2026-04-28

Last modified2026-10-07

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

Weakness classification

551230f0-3615-47bd-b7cc-93e92e730bbf: CWE-295

Primary references

551230f0-3615-47bd-b7cc-93e92e730bbf — Product
551230f0-3615-47bd-b7cc-93e92e730bbf — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Third Party Advisory