Product:
TeamViewer DEX
Summary
A command injection vulnerability was discovered in TeamViewer DEX, specifically within the 1E-ConfigMgrConsoleExtensions instructions. Improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.8 | CVE-2025-64993 |
Exploitation
To exploit this vulnerability, an attacker with Actioner privileges must send specially crafted input to the affected component. This input bypasses the input validation checks, allowing the attacker to execute arbitrary commands on the system. Successful exploitation can lead to remote execution of commands with elevated privileges, potentially compromising the integrity and confidentiality of the affected devices.
Affected Products
- TeamViewer DEX: Affected by command injection vulnerability allowing remote command execution.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by TeamViewer. Additionally, organizations should review their access controls and limit Actioner privileges to trusted users only. Regular security audits and monitoring for unusual activity can also help in identifying potential exploitation attempts.