CVE-2025-15559criticalCWE-78

CVE-2025-15559: fallo crítico en NesterSoft Inc. WorkTime (on-prem/cloud)

Unauthenticated OS Command Injection in NesterSoft WorkTime

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WorkTime

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 0.5%
An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
NesterSoft Inc. · WorkTime (on-prem/cloud)
CVEs relacionadas — NesterSoft Inc. WorkTime (on-prem/cloud)

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-15563MEDIUMBroken Access Control results in Denial of Service in NesterSoft WorkTimeEPSS 0.3%CVE-2025-15560HIGHSQL Injection in NesterSoft WorkTimeEPSS 0.3%CVE-2025-15562MEDIUMReflected Cross-Site Scripting in NesterSoft WorkTimeEPSS 0.2%CVE-2025-15561HIGHLocal Privilege Escalation in NesterSoft WorkTimeEPSS 0.1%