Executive brief
DeskTime is an automatic time tracking application used by businesses to monitor employee productivity and work hours. A security flaw in how the application handles software updates allows an attacker on the same network to intercept the update process and replace the legitimate software with a malicious file. If exploited, this could allow an attacker to gain control over a user's computer and execute unauthorized commands without any user interaction.
Technical details
The DeskTime desktop application (tested on version 1.3.671) contains a flaw in its TLS certificate validation logic within the update module. Specifically, the application's .NET implementation incorrectly handles SSLPolicyErrors, allowing the certificate check to pass even when 'RemoteCertificateChainErrors' are present. This enables a man-in-the-middle (MitM) attacker to present a self-signed certificate for desktime.com. Because the updater periodically checks for new versions and automatically downloads/executes the installer in the current user context, an attacker can redirect the client to a malicious executable. This results in user-level remote code execution (RCE) without requiring user interaction. The issue is fixed in version 1.3.674.
Affected products
- DeskTime DeskTime Time Tracking App < 1.3.674
Timeline
- 2025-05-23: other: Vulnerability discovered by SEC Consult
- 2025-06-26: other: Vendor first contacted
- 2025-09-16: other: CVE-2025-10539 reserved
- 2026-04-28: patched: Vendor released version 1.3.674 to address the issue
- 2026-04-28: advisory: Public advisory released by SEC Consult