Description

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

INFO

Published Date :

2026-04-28T07:52:23.279Z

Last Modified :

2026-04-29T19:32:10.480Z

Source :

SEC-VLab
AFFECTED PRODUCTS

The following products are affected by CVE-2025-10539 vulnerability.

Vendors Products
Desktime
  • Desktime Time Tracking App
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-10539.

URL Resource
http://seclists.org/fulldisclosure/2026/Apr/20 cve-icon
http://seclists.org/fulldisclosure/2026/Apr/21 cve-icon
https://desktime.com/download cve-icon cve-icon
https://r.sec-consult.com/desktime cve-icon cve-icon
https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-desktime-time-tracking-app/ cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact