CVE-2025-10539

Katalog CVE

CVSS 4.8 · Medium EPSS 0,18%

Kerentanan Improper Certificate Validation pada draugiemgroup desktime time tracking. Skor CVSS 3.1 4.8 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.

Rincian

Terbit di NVD

28 April 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation
CWE-296: Improper Following of a Certificate's Chain of Trust
CWE-494: Download of Code Without Integrity Check

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://r.sec-consult.com/desktime advisory pihak ketiga
• http://seclists.org/fulldisclosure/2026/Apr/20 exploit · mailing list · advisory pihak ketiga
• http://seclists.org/fulldisclosure/2026/Apr/21 exploit · mailing list · advisory pihak ketiga
• https://sec-consult.com/vulnerability-lab/advisory/missing-tls-certificate-validation-leading-to-rce-in-deskti... advisory pihak ketiga
• https://desktime.com/download product