CVE-2025-10539 - CVE House
Back to Database
Status published Unknown CVE-2025-10539

Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App

Vulnerability Description

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-10539

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Daniel Hirschberger, SEC Consult Vulnerability Lab
  • Thorger Jansen, SEC Consult Vulnerability Lab
  • Tobias Niemann, SEC Consult Vulnerability Lab
  • Marius Renner, SEC Consult Vulnerability Lab

References

Affected Vendor

Affected Software

DeskTime Time Tracking App
Vulnerable Versions:
0

Timeline

Official Publish: April 28th, 2026
Last Modified: April 29th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-295 CWE-296 CWE-494

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1040 Network Sniffing
Collection
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact