CVE-2025-64994CWE-427

CVE-2025-64994

Medium · published December 11, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1. The improper handling of executable search paths could allow local attackers with write access to a PATH directory on a device to escalate privileges and execute arbitrary code as SYSTEM.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00184 · 7.5th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2025-12-11T17:16Z
Affected products (1)
ProductVersionsFixed in
teamviewer/digital_employee_experience< 17.117.1
References (1)
https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/ · [email protected]
EPSS history
Timeline
  • 11 DEC 11:29Z
    Privilege Escalation via Uncontrolled Search Path in 1E-Nomad-SetWorkRate instruction
    cvelistv5