CVE-2025-64995

A privilege escalation vulnerability was discovered in TeamViewer DEX (formerly 1E DEX) prior to V17.1, specifically in the 1E-Nomad-SetWorkRate instruction. Improper handling of executable search paths could allow local attackers with write access to a PATH directory to escalate privileges and execute arbitrary code as SYSTEM.

A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instruction. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior to V25. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior to V15. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

A command injection vulnerability was discovered in TeamViewer DEX (formerly 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction prior to V21.1. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19.2. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction prior V21. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands, enabling remote execution of elevated commands on connected devices.