The DeskTime Time Tracking App before version 1.3.674 suffers from improper TLS certificate validation (CWE-295), enabling a man-in-the-middle attacker to intercept update requests and respond with malicious executables. This flaw can result in user-level remote code execution on the client machine. The vulnerability is documented as CVE-2025-10539 and involves additional weaknesses related to certificate validation and potentially unsafe resource loading (CWE-296, CWE-494). No CVSS score or vendor remediation information is currently available.

An attacker able to intercept network traffic between the DeskTime client and update servers can exploit this vulnerability to execute arbitrary code at the user privilege level by delivering malicious update payloads. This compromises the affected client system's security and integrity. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using untrusted networks for update operations or consider disabling automatic updates if feasible. Monitor the vendor's communications for updates on patches or official mitigations.