CVE-2025-64992
MediumCVSS 6.8Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior to V25. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
Risk Assessment
An attacker with Actioner privileges can remotely execute elevated commands on managed devices, potentially leading to full compromise of those endpoints. This poses a significant risk to organizations using TeamViewer DEX for fleet management.
Recommendation
Update TeamViewer DEX to V25 or later as soon as possible and restrict Actioner privileges to the minimum necessary accounts. Monitoring for unusual activity by accounts with these privileges is also recommended.
Other vulnerabilities in TeamViewer DEX
See all- CVE-2025-64993Medium
A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instruction. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- CVE-2025-64991Medium
A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior to V15. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- CVE-2025-64990Medium
A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction prior to V21.1. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- CVE-2025-64989High
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.
- CVE-2025-64988High
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19.2. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.
- CVE-2025-64987High
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.
- CVE-2025-64986High
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction prior V21. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.
Original NVD description (English source)
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS