CVE-2025-64994
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A privilege escalation vulnerability was discovered in TeamViewer DEX (formerly 1E DEX) prior to V17.1, specifically in the 1E-Nomad-SetWorkRate instruction. Improper handling of executable search paths could allow local attackers with write access to a PATH directory to escalate privileges and execute arbitrary code as SYSTEM.
Risk Assessment
The risk for the organization is the potential for a local user with limited privileges to gain full control of the device, leading to system and data integrity compromise.
Recommendation
It is recommended to immediately update TeamViewer DEX to version V17.1 or later and restrict write permissions to PATH directories on devices.
Other vulnerabilities in TeamViewer DEX
See all- CVE-2025-64995Medium
A privilege escalation vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically in the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction prior to V3.4. Improper protection of the execution path allows attackers with local access to hijack the process and execute arbitrary code with SYSTEM privileges.
- CVE-2025-64993Medium
A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instruction. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- CVE-2025-64992Medium
A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior to V25. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- CVE-2025-64991Medium
A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior to V15. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- CVE-2025-64990Medium
A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction prior to V21.1. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
- CVE-2025-64989High
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.
- CVE-2025-64988High
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19.2. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.
- CVE-2025-64987High
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.
- CVE-2025-64986High
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction prior V21. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.
Original NVD description (English source)
A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1. The improper handling of executable search paths could allow local attackers with write access to a PATH directory on a device to escalate privileges and execute arbitrary code as SYSTEM.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS