CVE-2025-15561highCWE-269

CVE-2025-15561: high-severity vulnerability in NesterSoft Inc. WorkTime (on-prem/cloud)

Local Privilege Escalation in NesterSoft WorkTime

Published · Updated

Follow this CVE+ Monitor WorkTime

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 0.1%
An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named  WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory, which is writable by "Everyone". The executable will then be run by the WorkTime monitoring daemon.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
NesterSoft Inc. · WorkTime (on-prem/cloud)
Related CVEs — NesterSoft Inc. WorkTime (on-prem/cloud)

In the same product, most dangerous first.

CVE-2025-15559CRITICALUnauthenticated OS Command Injection in NesterSoft WorkTimeEPSS 0.5%CVE-2025-15563MEDIUMBroken Access Control results in Denial of Service in NesterSoft WorkTimeEPSS 0.3%CVE-2025-15560HIGHSQL Injection in NesterSoft WorkTimeEPSS 0.3%CVE-2025-15562MEDIUMReflected Cross-Site Scripting in NesterSoft WorkTimeEPSS 0.2%