CVE-2025-10539

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-10539
Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

4.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://desktime.com/download Product
https://r.sec-consult.com/desktime Third Party Advisory
http://seclists.org/fulldisclosure/2026/Apr/20 Exploit Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2026/Apr/21 Exploit Mailing List Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:draugiemgroup:desktime_time_tracking:*:*:*:*:*:*:*:*
History

18 May 2026, 18:21

Type Values Removed Values Added
CPE cpe:2.3:a:draugiemgroup:desktime_time_tracking:*:*:*:*:*:*:*:*
First Time Draugiemgroup
Draugiemgroup desktime Time Tracking
References () https://desktime.com/download - () https://desktime.com/download - Product
References () https://r.sec-consult.com/desktime - () https://r.sec-consult.com/desktime - Third Party Advisory
References () http://seclists.org/fulldisclosure/2026/Apr/20 - () http://seclists.org/fulldisclosure/2026/Apr/20 - Exploit, Mailing List, Third Party Advisory
References () http://seclists.org/fulldisclosure/2026/Apr/21 - () http://seclists.org/fulldisclosure/2026/Apr/21 - Exploit, Mailing List, Third Party Advisory
References () https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/ - () https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/ - Third Party Advisory

29 Apr 2026, 20:16

Type Values Removed Values Added
References
  • () http://seclists.org/fulldisclosure/2026/Apr/20 -
  • () http://seclists.org/fulldisclosure/2026/Apr/21 -

28 Apr 2026, 15:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.8
References
  • () https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/ -

28 Apr 2026, 09:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-28 09:16

Updated : 2026-05-18 18:21

NVD link : CVE-2025-10539

Mitre link : CVE-2025-10539

CVE.ORG link : CVE-2025-10539

JSON object : View

Products Affected

draugiemgroup

  • desktime_time_tracking
CWE
CWE-295

Improper Certificate Validation

CWE-296

Improper Following of a Certificate's Chain of Trust

CWE-494

Download of Code Without Integrity Check