Product:
TeamViewer DEX
Summary
A command injection vulnerability was discovered in TeamViewer DEX, specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior to V21.1. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.2 | CVE-2025-64989 |
Exploitation
To exploit this vulnerability, an authenticated attacker with Actioner privileges can send specially crafted input to the affected instruction. This input bypasses the improper validation checks, allowing the attacker to execute arbitrary commands on the connected devices. The low attack complexity and network attack vector make this vulnerability particularly concerning.
Affected Products
- TeamViewer DEX: Affected by command injection vulnerability allowing remote command execution.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of TeamViewer DEX where the issue has been addressed. Additionally, it is recommended to review and restrict Actioner privileges to minimize the risk of exploitation.