Unauthenticated OS Command Injection in NesterSoft WorkTime
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.
Summary
An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generate and download the WorkTime client from the WorkTime server is vulnerable in the “guid” parameter. This allows an attacker to execute arbitrary commands on the WorkTime server as NT Authority\SYSTEM with the highest privileges. Attackers are able to access or manipulate sensitive data and take over the whole server.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NesterSoft Inc. | WorkTime (on-prem/cloud) | up to 11.8.8 | — | No fix listed | CNA |
- WorkTime (on-prem/cloud) VendorNesterSoft Inc. Affected up to 11.8.8 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nestersoft:worktime:*:*:*:*:cloud:*:*:* | up to 11.8.8 | Vulnerable | NesterSoft Inc. |
| cpe:2.3:a:nestersoft:worktime:*:*:*:*:on-premise:*:*:* | up to 11.8.8 | Vulnerable | NesterSoft Inc. |
- cpe:2.3:a:nestersoft:worktime:*:*:*:*:cloud:*:*:* Versions up to 11.8.8 Vulnerable ·NesterSoft Inc.
- cpe:2.3:a:nestersoft:worktime:*:*:*:*:on-premise:*:*:* Versions up to 11.8.8 Vulnerable ·NesterSoft Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-15559
- 2026-10-03 Alias added: GHSA-p5gf-vhgm-432f
References
Advisory 1
More NesterSoft Inc. Worktime vulnerabilities
- TI-2025-14200 Local Privilege Escalation in NesterSoft WorkTime CVSS 3.1HIGH 7.8
- TI-2025-14199 SQL Injection in NesterSoft WorkTime CVSS 3.1HIGH 8.8
- TI-2025-14202 Broken Access Control results in Denial of Service in NesterSoft WorkTime CVSS 3.1MEDIUM 5.3
- TI-2025-14201 Reflected Cross-Site Scripting in NesterSoft WorkTime CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-15559 · CVE Program
- CVE-2025-15559 · NVD
- FIRST EPSS
- GHSA-p5gf-vhgm-432f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences