CVE-2025-15561 — Local Privilege Escalation in NesterSoft WorkTime

CVE-2025-15561

Local Privilege Escalation in NesterSoft WorkTime PUBLISHED

Description (CNA)

An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYSTEM. A malicious executable must be named WTWatch.exe and dropped in the C:\ProgramData\wta\ClientExe directory, which is writable by "Everyone". The executable will then be run by the WorkTime monitoring daemon.

Affected (CNA)

Vendor / product	Versions
NesterSoft Inc. / WorkTime (on-prem/cloud)	affected <= 11.8.8

CWE

CWE-269

References

https://r.sec-consult.com/worktime

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.