CVE-2019-12162

CVE-2019-12162 describes a critical vulnerability in Upwork Time Tracker version 5.2.2.716, where the application fails to validate the SHA256 hash of downloaded updates. This oversight allows an attacker to replace the legitimate update.exe with malicious code, potentially leading to arbitrary code execution or local privilege escalation. With a CVSS score of 7.8 (High), the vulnerability requires local access and low privileges but can result in complete compromise of confidentiality, integrity, and availability. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.