Product:
TeamViewer DEX
Summary
A command injection vulnerability was discovered in TeamViewer DEX, specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior to V25. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.8 | CVE-2025-64992 |
Exploitation
To exploit this vulnerability, an attacker with Actioner privileges must send specially crafted input to the 1E-Nomad-PauseNomadJobQueue instruction. This input bypasses the improper validation checks, allowing the attacker to execute arbitrary commands on the affected devices remotely.
Affected Products
- TeamViewer DEX: Affected versions prior to V25 are vulnerable to command injection through the 1E-Nomad-PauseNomadJobQueue instruction.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of TeamViewer DEX that addresses the command injection issue. Additionally, it is recommended to review and restrict Actioner privileges to minimize the risk of exploitation.