CVE-2025-64986
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-11
Assigner: TeamViewer Germany GmbH
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| teamviewer | teamviewer_dex | 21 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a command injection flaw in TeamViewer DEX, specifically in the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction before version 21. It occurs due to improper input validation, allowing authenticated users with Actioner privileges to inject and execute arbitrary commands remotely with elevated privileges on connected devices.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to remote execution of elevated commands on devices connected to the TeamViewer DEX platform. This could allow attackers to take control of affected devices, potentially leading to data compromise, system disruption, or unauthorized actions.