This vulnerability arises from improper validation of TLS certificates in the DeskTime Time Tracking App before version 1.3.674. Because the app does not correctly verify the authenticity of the update server's certificate, an attacker who can intercept or manipulate network traffic can respond to update requests with malicious executables. Successful exploitation leads to remote code execution at the user privilege level on the affected client. The CVSS 3.1 base score is 4.8, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

An attacker capable of performing a man-in-the-middle attack on the network path can deliver malicious code to the DeskTime client during update checks, resulting in user-level remote code execution. This could compromise the affected system's confidentiality and integrity to a limited extent. There is no indication of impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using untrusted networks or ensure network traffic is protected by additional means such as VPNs. Monitor vendor communications for updates regarding a patch or official mitigation steps.