GCVE-1988-2026-0237

Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-11 07:38
VLAI
Title
SEC Consult SA-20260427-0 :: Missing TLS Certificate Validation leading to RCE in DeskTime Time Tracking App
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260427-0 > ======================================================================= title: Missing TLS Certificate Validation leading to RCE product: DeskTime Time Tracking App vulnerable version: 1.3.671 fixed version: - CVE number: CVE-2025-10539              impact: medium homepage:https://desktime.com found: 2025-05-23 by: Daniel Hirschberger Thorger Jansen (Office Bochum) Tobias Niemann (Office Bochum) Marius Renner (Office Bochum) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "A time tracker that won't interrupt your team's workflow. Ever. DeskTime is an automatic time tracking tool that will help you increase transparency in your team, enable easy hybrid work, and optimize work hours." Source:https://desktime.com/ Business recommendation: ------------------------ The vendor did not provide a patch nor a timeline when a fix will be available. In case you are using this product, please approach the vendor and demand a fix. SEC Consult highly recommends performing a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues. Vulnerability overview/description: ----------------------------------- 1) Missing TLS Certificate Validation leading to RCE (CVE-2025-10539) Due to missing TLS Certificate Validation, attackers, who can inject themselves into the network path between the client and the DeskTime update servers, can return a malicious executable in response to an update request and achieve user-level code execution on the client. Proof of concept: ----------------- 1) Missing TLS Certificate Validation leading to RCE (CVE-2025-10539) The DeskTime application periodically checks if there is an update for itself. This is done via an HTTPS URL, but the server certificate is not checked correctly. The certificate validation is implemented as follows: <cert_validation.png> There are two possibilities to pass the certificate checks: 1. There are no errors during the certificate validation 2. The request was made by the class `HttpWebRequest` and the used certificate is object of the class `X509Certificate2` and the SSLPolicyError has the value `RemoteCertificateChainErrors`. 2) should be further scrutinized. The .NET documentation for SSLPolicyErrors shows that this enum has the following values and meanings: https://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslpolicyerrors None = No SSL policy errors. RemoteCertificateNotAvailable = Certificate not available. RemoteCertificateNameMismatch = Certificate name mismatch. RemoteCertificateChainErrors = ChainStatus has returned a non empty array. This means that as long as any certificate is provided by the server and that it is issued for the expected hostname, it does not matter if there are any errors in the validation of the certificate chain. This effectively allows man-in-the-middle attacks by using self-signed certificates. To validate this finding on the machine where DeskTime is installed, the following steps have to be performed. Add an entry for `desktime.com` to `C:\Windows\System32\drivers\etc\hosts` and point it to localhost: -------------------------------------------------------------------------------- 127.0.0.1 desktime.com -------------------------------------------------------------------------------- Create a listener in Burp Proxy on port `443`, enable `Force use of TLS` and `Invisible Proxy support`. <burp_request_handling.png> Since desktime.com now points to 127.0.0.1 because of the modification of the hosts file, we have to create a static DNS override in Burp to let the hostname `desktime.com` resolve to the real upstream IP. <burp_dns_override.png> When DeskTime is started now, the Burp HTTP history shows all client requests. <burp_requests.png> If the update function is triggered, a request containing the currently installed version, the userID and some other parameters, is sent to the server. <update_request.png> The server responds with the version of the installer that it currently hosts, as well as a link to that version. <update_response.png> If the returned version is greater than the one installed on the client machine, it is automatically downloaded and installed in the current user context. By performing the mentioned man-in-the-middle attack, it is therefore possible to achieve Remote Code Execution. For example, the following Burp Response Rewrite Rule can be used to automatically refer the client to another update. <replace_rule.png> In this case, the client is redirected to a locally hosted copy of the Windows calculator `calc.exe`. <malicious_update.webm> Since the updater triggers automatically every hour, no user interaction is necessary to exploit this vulnerability. Vulnerable / tested versions: ----------------------------- The following version has been tested which was the latest version available at the time of the test: * 1.3.671 Vendor contact timeline: ------------------------ 2025-06-26: Contacting vendor throughsupport () desktime com; Vendor asks to send advisory information unencrypted; We send the advisory. 2025-07-02: Vendor states that this is a duplicate and they are already aware. 2025-07-03: We ask for a timeline for the remediation and about assigning a CVE number. 2025-07-17: Vendor responds that it will take some time to patch this issue. We respond that we can create a CVE number and ask them to notify us once the patch is released. 2025-07-18: Vendor informs us that the next public version will include the fix, but no timeline was provided 2025-09-16: Reserved CVE-2025-10539, asking for a status update; Vendor responds that this security issue "can't be used under standard circumstances, and very specific conditions must be met". It is included in future update, but no timeline provided. Support agent closes the ticket; We ask if the advisory can be published since "the vulnerability can not be exploited under standard circumstances"; Vendor wants to double check with their team. 2025-09-18: Vendor asks for deadline extension. 2025-09-23: We reply that our 50 day deadline was over on 2025-08-15 and that the industry standard of 90 days will be over (tomorrow) on 2025-09-24. We add that we can delay the publication if they can provide a timeline for the fix and if they are not able to fix it before then for important reasons. 2025-09-16: Vendor has to clarify the release internally. 2025-09-18: Vendor asks what timeframe we can give them. 2025-09-23: We re-iterate our timeframes from the Responsible Disclosure Policy and note that the 90-day standard timeframe is over tomorrow. 2025-09-23: Vendor asks internally for timeline but forecasts end of this year. 2025-10-06: Vendor wants to delay developing a fix since the probability for exploitation is low, the fix is scheduled to be delivered in a bigger update in Q1 2026. 2025-10-15: We agree that the vulnerability is not easy to exploit and lower the risk to medium. Since it is now rated medium and we assume that the fix is trivial, we do not agree with waiting until Q1. 2025-11-14: The vendor plans to have a fix ready on 2025-12-08. 2026-03-26: Following up whether everything is fixed by now; explaining delays on our side. Vendor will clarify progress internally. 2026-04-14: Asking for a status update again. Vendor tells us that the issue is more complex than expected, they need more time. Informing them about the planned release on 23rd April, as we have given them nearly a year of patching time. Vendor responds that they are taking our plan into consideration. 2026-04-27: Release of security advisory. Solution: --------- The vendor did not provide a patch nor a timeline when a fix will be available. In case you are using this product, please approach the vendor and demand a fix. Workaround: ----------- None Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Atos business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your applicationhttps://sec-consult.com/career/ Interested in improving your cybersecurity with the experts of SEC Consult? Contact our local officeshttps://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web:https://www.sec-consult.com Blog:https://blog.sec-consult.com X:https://x.com/sec_consult EOF Daniel Hirschberger, Thorger Jansen, Tobias Niemann, Marius Renner / @2026 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Desktime SEC Consult SA-20260427-0 Affected: unknown
guessed Create a notification for this product.
Credits
SEC Consult Vulnerability Lab via Fulldisclosure
Relationships
reference GCVE-1988-2026-0237 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260427-0",
          "vendor": "Desktime",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260427-0 \u003e\n=======================================================================\n              title: Missing TLS Certificate Validation leading to RCE\n            product: DeskTime Time Tracking App\n vulnerable version: 1.3.671\n      fixed version: -\n         CVE number: CVE-2025-10539\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n           homepage:https://desktime.com\n              found: 2025-05-23\n                 by: Daniel Hirschberger\n                     Thorger Jansen (Office Bochum)\n                     Tobias Niemann (Office Bochum)\n                     Marius Renner (Office Bochum)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"A time tracker that won\u0027t interrupt your team\u0027s workflow. Ever.\nDeskTime is an automatic time tracking tool that will help you increase\ntransparency in your team, enable easy hybrid work, and optimize work hours.\"\n\nSource:https://desktime.com/\n\n\nBusiness recommendation:\n------------------------\nThe vendor did not provide a patch nor a timeline when a fix will be available.\nIn case you are using this product, please approach the vendor and demand a fix.\n\nSEC Consult highly recommends performing a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Missing TLS Certificate Validation leading to RCE (CVE-2025-10539)\nDue to missing TLS Certificate Validation, attackers, who can inject themselves\ninto the network path between the client and the DeskTime update servers, can\nreturn a malicious executable in response to an update request and achieve\nuser-level code execution on the client.\n\n\nProof of concept:\n-----------------\n1) Missing TLS Certificate Validation leading to RCE (CVE-2025-10539)\nThe DeskTime application periodically checks if there is an update for itself.\nThis is done via an HTTPS URL, but the server certificate is not checked\ncorrectly.\n\nThe certificate validation is implemented as follows:\n\n\u003ccert_validation.png\u003e\n\nThere are two possibilities to pass the certificate checks:\n1. There are no errors during the certificate validation\n2. The request was made by the class `HttpWebRequest` and\n   the used certificate is object of the class `X509Certificate2` and\n   the SSLPolicyError has the value `RemoteCertificateChainErrors`.\n\n2) should be further scrutinized.\n\nThe .NET documentation for SSLPolicyErrors shows that this enum has the\nfollowing values and meanings:\nhttps://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslpolicyerrors\n\nNone = No SSL policy errors.\nRemoteCertificateNotAvailable = Certificate not available.\nRemoteCertificateNameMismatch = Certificate name mismatch.\nRemoteCertificateChainErrors = ChainStatus has returned a non empty array.\n\nThis means that as long as any certificate is provided by the server and that it\nis issued for the expected hostname, it does not matter if there are any errors\nin the validation of the certificate chain.\nThis effectively allows man-in-the-middle attacks by using self-signed\ncertificates.\n\nTo validate this finding on the machine where DeskTime is installed, the\nfollowing steps have to be performed.\n\nAdd an entry for `desktime.com` to `C:\\Windows\\System32\\drivers\\etc\\hosts` and\npoint it to localhost:\n\n--------------------------------------------------------------------------------\n127.0.0.1 desktime.com\n--------------------------------------------------------------------------------\n\nCreate a listener in Burp Proxy on port `443`, enable `Force use of TLS` and\n`Invisible Proxy support`.\n\n\u003cburp_request_handling.png\u003e\n\nSince desktime.com now points to 127.0.0.1 because of the modification of the\nhosts file, we have to create a static DNS override in Burp to let the hostname\n`desktime.com` resolve to the real upstream IP.\n\n\u003cburp_dns_override.png\u003e\n\nWhen DeskTime is started now, the Burp HTTP history shows all client requests.\n\n\u003cburp_requests.png\u003e\n\nIf the update function is triggered, a request containing the currently\ninstalled version, the userID and some other parameters, is sent to the server.\n\n\u003cupdate_request.png\u003e\n\nThe server responds with the version of the installer that it currently hosts,\nas well as a link to that version.\n\n\u003cupdate_response.png\u003e\n\nIf the returned version is greater than the one installed on the client machine,\nit is automatically downloaded and installed in the current user context.\n\nBy performing the mentioned man-in-the-middle attack, it is therefore possible\nto achieve Remote Code Execution.\n\nFor example, the following Burp Response Rewrite Rule can be used to\nautomatically refer the client to another update.\n\n\u003creplace_rule.png\u003e\n\nIn this case, the client is redirected to a locally hosted copy of the Windows\ncalculator `calc.exe`.\n\n\u003cmalicious_update.webm\u003e\n\nSince the updater triggers automatically every hour, no user interaction is\nnecessary to exploit this vulnerability.\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 1.3.671\n\n\nVendor contact timeline:\n------------------------\n2025-06-26: Contacting vendor throughsupport () desktime com;\n            Vendor asks to send advisory information unencrypted;\n            We send the advisory.\n2025-07-02: Vendor states that this is a duplicate and they are already\n            aware.\n2025-07-03: We ask for a timeline for the remediation and about\n            assigning a CVE number.\n2025-07-17: Vendor responds that it will take some time to patch this\n            issue.\n            We respond that we can create a CVE number and ask them\n            to notify us once the patch is released.\n2025-07-18: Vendor informs us that the next public version will include\n            the fix, but no timeline was provided\n2025-09-16: Reserved CVE-2025-10539, asking for a status update;\n            Vendor responds that this security issue \"can\u0027t be used under\n            standard circumstances, and very specific conditions must be met\".\n            It is included in future update, but no timeline provided.\n            Support agent closes the ticket;\n            We ask if the advisory can be published since \"the vulnerability\n            can not be exploited under standard circumstances\";\n            Vendor wants to double check with their team.\n2025-09-18: Vendor asks for deadline extension.\n2025-09-23: We reply that our 50 day deadline was over on 2025-08-15 and\n            that the industry standard of 90 days will be over (tomorrow)\n            on 2025-09-24. We add that we can delay the publication if\n            they can provide a timeline for the fix and if they are not\n            able to fix it before then for important reasons.\n2025-09-16: Vendor has to clarify the release internally.\n2025-09-18: Vendor asks what timeframe we can give them.\n2025-09-23: We re-iterate our timeframes from the Responsible\n            Disclosure Policy and note that the 90-day standard\n            timeframe is over tomorrow.\n2025-09-23: Vendor asks internally for timeline but forecasts\n            end of this year.\n2025-10-06: Vendor wants to delay developing a fix since the\n            probability for exploitation is low, the fix is\n            scheduled to be delivered in a bigger update in Q1 2026.\n2025-10-15: We agree that the vulnerability is not easy to exploit\n            and lower the risk to medium. Since it is now rated\n            medium and we assume that the fix is trivial, we do not\n            agree with waiting until Q1.\n2025-11-14: The vendor plans to have a fix ready on 2025-12-08.\n2026-03-26: Following up whether everything is fixed by now; explaining delays\n            on our side. Vendor will clarify progress internally.\n2026-04-14: Asking for a status update again. Vendor tells us that the issue\n            is more complex than expected, they need more time. Informing them\n            about the planned release on 23rd April, as we have given them nearly\n            a year of patching time. Vendor responds that they are taking our\n            plan into consideration.\n2026-04-27: Release of security advisory.\n\n\nSolution:\n---------\nThe vendor did not provide a patch nor a timeline when a fix will be available.\nIn case you are using this product, please approach the vendor and demand a fix.\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cybersecurity with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:https://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF Daniel Hirschberger, Thorger Jansen, Tobias Niemann, Marius Renner / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:38:51Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/20"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Apr/20"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://desktime.com"
        },
        {
          "url": "https://desktime.com/"
        },
        {
          "url": "https://learn.microsoft.com/en-us/dotnet/api/system.net.security.sslpolicyerrors"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Apr/20"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260427-0 :: Missing TLS Certificate Validation leading to RCE in DeskTime Time Tracking App",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-10539",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0237",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Apr/20",
            "automated": true,
            "contentSha256": "e4037d0dfa5b0b431b8c66c39d3b0b13a6f3a23f4d173d3c6ab8c9fcf7aae286",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Apr/20",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-04-27T10:53:17Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0237"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-11T07:38:51Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0237"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.