Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 28, 2026 · NIST NVD

   Detected

   Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

2. Oct 7, 2026 · NIST NVD

   Updated

   Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

Affected

• cpe draugiemgroup/desktime time trackingversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-10539

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-10539

  Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. Th

  nvd.nist.gov

References

• Exploit · seclists.org
• Exploit · seclists.org
• Product · desktime.com
• Third Party Advisory · r.sec-consult.com
• Third Party Advisory · sec-consult.com