Description
Due to improper TLS certificate validation in the DeskTime Time Tracking App before version 1.3.674, attackers who can position themselves in the network path between the client and the DeskTime update servers can return a malicious executable in response to an update request. This allows the attacker to achieve user-level remote code execution on the affected client.
Affected products
draugiemgroup: desktime time tracking
References5
- seclists.org/fulldisclosure/2026/Apr/20 ExploitMailing ListThird Party Advisory
- seclists.org/fulldisclosure/2026/Apr/21 ExploitMailing ListThird Party Advisory
- desktime.com/download Product
- r.sec-consult.com/desktime Third Party Advisory
- sec-consult.com/vulnerability-lab/advisory/missing-tls-certific… Third Party Advisory
Metrics
- CVSS 3.1
-
4.8
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - EPSS — exploit probability
- 0% percentile: 8 · as of 13 November 2026
- CWE
- CWE-295CWE-296CWE-494
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.