CVE-2025-64988
BaseFortify
Publication date: 2025-12-11
Last updated on: 2025-12-11
Assigner: TeamViewer Germany GmbH
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| teamviewer | 1e_dex | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
Exploitation of this vulnerability allows an attacker with Actioner privileges to remotely execute elevated commands on devices connected to the TeamViewer DEX platform. This can lead to unauthorized control, data compromise, or disruption of affected systems.
Can you explain this vulnerability to me?
This vulnerability is a command injection flaw in TeamViewer DEX (formerly 1E DEX) versions prior to 19.2. It occurs in the 1E-Nomad-GetCmContentLocations instruction due to improper input validation. Authenticated attackers with Actioner privileges can exploit this to inject arbitrary commands, leading to remote execution of elevated commands on connected devices.