DeskTime Time Tracking App processes update requests from its servers but fails to properly validate TLS certificates. When an attacker can insert themselves in the network path between a client and the update server, they can supply a malicious executable in the update response. The client then accepts and runs the file, giving the attacker code execution on the endpoint at the user’s level. This weakness is associated with certificate validation and code signing failures (CWE-295, CWE-296, CWE-494).

All installations of DeskTime Time Tracking App running any version earlier than v1.3.674 are affected. The vendor’s official fix is the patched release v1.3.674, available from the DeskTime download page.

With a CVSS score of 4.8, the vulnerability is considered moderate severity. The EPSS score of less than 1 % indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits. Nonetheless, attackers with a position in the network path could exploit this flaw. Remediation requires applying the vendor patch, enforcing strict TLS certificate validation for update traffic, or blocking outgoing connections to the update servers if patching cannot yet occur.