CVE-2025-15559

Status: AnalyzedCritical (9.8)—

An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base score: 9.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.46%
Percentile among all scored CVEs: 38
Score date: 10/6/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access95 %
Primary impactT1059 Command and Scripting Interpreterexecution95 %
Secondary impactT1005 Data from Local Systemcollection85 %
Secondary impactT1068 Exploitation for Privilege Escalationprivilege escalation90 %

Inyección de comandos OS en parámetro 'guid' de API sin autenticación (AV:N/PR:N/UI:N). CWE-78 confirma ejecución como NT Authority\SYSTEM con acceso total a datos y control del servidor.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account Management Execution Prevention Application Isolation and Sandboxing Exploit Protection Update Software Vulnerability Scanning

Affected technologies (1)

Nestersoft — Worktime

CWEs

CWE-78

References

https://r.sec-consult.com/worktime

Raw JSON (NVD)

Show

{
  "id": "CVE-2025-15559",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-15559",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-23T18:30:20.488085Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "affectedData": [
        {
          "vendor": "NesterSoft Inc.",
          "product": "WorkTime (on-prem/cloud)",
          "versions": [
            {
              "status": "affected",
              "version": "<= 11.8.8"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-02-19T11:15:55.423",
  "references": [
    {
      "url": "https://r.sec-consult.com/worktime",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server."
    },
    {
      "lang": "es",
      "value": "Un atacante no autenticado puede inyectar comandos del SO al llamar a un endpoint de la API del servidor en NesterSoft WorkTime. La llamada a la API del servidor para generar y descargar el cliente de WorkTime desde el servidor de WorkTime es vulnerable en el parámetro 'guid'. Esto permite a un atacante ejecutar comandos arbitrarios en el servidor de WorkTime como NT Authority\\SYSTEM con los privilegios más altos. Los atacantes pueden acceder o manipular datos sensibles y tomar el control de todo el servidor."
    }
  ],
  "lastModified": "2026-06-17T08:38:01.460",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nestersoft:worktime:*:*:*:*:cloud:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8A53FE8-6F29-462D-B7EB-C3E4F25DBEC3",
              "versionEndIncluding": "11.8.8"
            },
            {
              "criteria": "cpe:2.3:a:nestersoft:worktime:*:*:*:*:on-premise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A831FDF-1B71-48B4-BA2D-D2EFB151161A",
              "versionEndIncluding": "11.8.8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"
}