CVE-2025-64995CWE-427

CVE-2025-64995

Medium · published December 11, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
5.5
In the wild
Unconfirmed
What it is

A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction prior V3.4. Improper protection of the execution path on the local device allows attackers, with local access to the device during execution, to hijack the process and execute arbitrary code with SYSTEM privileges.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.5th percentile
Weakness
CWE-427 · Uncontrolled Search Path Element
Published
2025-12-11T17:16Z
Affected products (1)
ProductVersionsFixed in
teamviewer/digital_employee_experience< 3.43.4
References (1)
https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/ · [email protected]
EPSS history
Timeline
  • 11 DEC 11:29Z
    Privilege Escalation via Process Hijacking in 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction
    cvelistv5