Back
CVE-2025-10539
Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App
Medium4.8EPSS 0.18%
- Published
- Updated
- Reserved
- Assigned by
- SEC-VLab
Description
Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVDNVD · Analyzed | 3.1 | Medium4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.18% · top 92% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.
Weakness
- CWE-295 Improper certificate validation (opens in a new tab)All about CWE-295 and its CVEs
- CWE-296 Improper following of a certificate's chain of trust (opens in a new tab)All about CWE-296 and its CVEs
- CWE-494 Download of code without integrity check (opens in a new tab)All about CWE-494 and its CVEs
Affected products
DeskTime · DeskTime Time Tracking App
- affected < 1.3.674
What to do
Solution: The vendor provides a patched version v1.3.674 which can be obtained from: https://desktime.com/download
References (5)
- https://r.sec-consult.com/desktime (opens in a new tab)third-party-advisory
- https://desktime.com/download (opens in a new tab)patch
- https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/ (opens in a new tab)exploit
- http://seclists.org/fulldisclosure/2026/Apr/20 (opens in a new tab)
- http://seclists.org/fulldisclosure/2026/Apr/21 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-10539)Record last updated .