CVE-2025-64987CWE-20CWE-77command-injection

CVE-2025-64987

High · published December 11, 2025

CVSS v3.1
7.2
EPSS
1%
Percentile
66.9
In the wild
Unconfirmed
What it is

⚡ A crafty command injection vulnerability lurks in TeamViewer DEX, waiting for an authenticated attacker with Actioner privileges to drop arbitrary commands like a master chef swapping ingredients in a recipe! Think of it like a restaurant where a waiter can sneak in their own secret ingredients into a dish without the chef ever knowing — that's how this vulnerability works, allowing an attacker to inject commands that the system accepts as valid. An attacker could exploit this to execute elevated commands on connected devices, potentially leading to unauthorized access and control. It's like giving someone the keys to the entire kitchen and letting them cook whatever they want, which could be absolutely devastating for your network security.

Put simply

Think of it like a restaurant where a waiter can sneak in their own secret ingredients into a dish without the chef ever knowing — that's how this vulnerability works, allowing an attacker to inject commands that the system accepts as valid. This command injection vulnerability in TeamViewer DEX allows authenticated users to bypass input validation in the 1E-Explorer-TachyonCore-CheckSimpleIoC function, enabling them to execute arbitrary commands remotely on devices within the platform.

What to do

An attacker could exploit this to execute elevated commands on connected devices, potentially leading to unauthorized access and control. It's like giving someone the keys to the entire kitchen and letting them cook whatever they want, which could be absolutely devastating for your network security. Update TeamViewer DEX to the latest version immediately to patch this vulnerability. Review user permissions and limit Actioner privileges to only those who absolutely need them. Conduct a security audit on devices connected to the platform to ensure no unauthorized commands have been executed. You've got this! With quick action, you'll keep your devices safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01161 · 66.9th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-12-11T17:16Z
Affected products (1)
ProductVersionsFixed in
teamviewer/digital_employee_experience< 21.021.0
References (1)
EPSS history
Timeline
  • 11 DEC 11:26Z
    Command Injection in 1E-Explorer-TachyonCore-CheckSimpleIoC Instruction
    cvelistv5