TeamViewer DEX Client
CVE-2025-12687
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network foothold
-
DeliveryReach NomadBranch.exe service
-
ExploitSend crafted command
-
ExecutionTrigger input-validation flaw (CWE-20)
-
ImpactCrash and terminate service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires the attacker to be on the same adjacent/local network (AV:A) as a Windows host running the TeamViewer DEX / former 1E Client Content Distribution Service (NomadBranch.exe) at a version prior to 25.11; the attacker then sends a crafted command that the service fails to validate (CWE-20). No authentication (PR:N) and no user interaction (UI:N) are required. Limiting factors: exploitation is not routable from the internet (adjacent network only), impact is confined to availability (service crash/termination, recoverable on restart) with no confidentiality or integrity effect, and hosts updated to 25.11 or later are not affected. |
| Impact | This is a moderate-severity, availability-only denial-of-service flaw whose signals are internally consistent and point to limited real-world urgency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) describes an unauthenticated, low-complexity attack requiring adjacent-network access (same L2 segment / logical network), with no confidentiality or integrity impact - only service termination of NomadBranch.exe. Exploitation-probability signals reinforce a low priority: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code is identified in the provided data, so this is no public exploit identified at time of analysis. No SSVC decision data was supplied; inferring from the vector, automatability is plausible (no auth, no UI) but technical impact is partial (availability-only, scope unchanged), which caps the real-world consequence at service disruption rather than compromise. There are no conflicting signals here - a crafted-command DoS over the adjacent network matches AV:A and A:H cleanly. Net: a legitimate patch-worthy bug for the affected fleet, but not an emergency; it is a high-ish CVSS number driven by A:H, not evidence of active or widespread exploitation. |
| Exploit ScenarioDerived | An attacker with a foothold on the same local/adjacent network as a managed Windows endpoint sends a crafted command to the Content Distribution Service (NomadBranch.exe), causing the process to crash and terminate. This disrupts content distribution / endpoint management on that host; no code execution or data access occurs. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Denial of service in TeamViewer DEX Client (formerly 1E Client) for Windows prior to version 25.11 lets an unauthenticated attacker who is already on the same adjacent network segment crash the Content Distribution Service (NomadBranch.exe) with a crafted command, terminating the service process. Impact is limited to availability (CVSS 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - there is no confidentiality or integrity effect and the service can be restarted on the host - so exploitation is only possible laterally from the local network and not from the internet, and hosts on 25.11 or later are unaffected. There is no public exploit identified at time of analysis and no KEV listing; EPSS is low at 0.21% (11th percentile), consistent with a moderate, availability-only issue of limited real-world urgency.
RemediationAI
Vendor-released patch: upgrade the TeamViewer DEX Client (formerly 1E Client) for Windows to version 25.11 or later, following the instructions in TeamViewer security bulletin TV-2025-1005 (https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1005/); this is the primary and definitive fix and removes the vulnerable input handling in NomadBranch.exe. Where immediate upgrade is not possible, restrict who can reach the Content Distribution Service by host firewall rules that allow inbound traffic only from known content-distribution peers and by segmenting management/endpoint networks (802.1X or equivalent network access control) so untrusted adjacent hosts cannot send commands to the service - the trade-off is that overly tight filtering can break peer-to-peer content distribution, forcing clients to download packages across the WAN and slowing software deployments. Enable Windows Service Recovery so the Content Distribution Service automatically restarts if it terminates; this shortens the outage window but does not prevent the crash or the underlying flaw. Since the issue is adjacent-network only, exposing the service beyond the local segment - or bridging it to untrusted networks - should be avoided, and service termination events for NomadBranch.exe should be monitored as an indicator of attempted abuse. No public exploit code has been identified, so these compensating controls are precautionary rather than emergency measures.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Content Distribution Service shipped with the TeamViewer Digital Employee Experience (DEX) Client, previously branded the 1E Client; the service binary is NomadBranch.exe and its role is peer-to-peer delivery of software packages and content across enterprise networks so that endpoints pull content from local peers rather than across the WAN. Because that design requires the service to accept instructions from other machines on the same network segment, its command/input handling surface is reachable by adjacent hosts without authentication. The root cause is classified as CWE-20 (Improper Input Validation): the crafted command is not adequately validated, producing an unhandled condition that terminates the service process. The CPE record cpe:2.3:a:teamviewer:digital_employee_experience:*:*:*:*:*:*:*:* identifies the TeamViewer DEX product line while carrying no explicit version bounds, so the authoritative scope comes from the vendor bulletin (Windows deployments below 25.11). The CVSS vector confirms the attack path is adjacent network (AV:A), low complexity (AC:L), unauthenticated (PR:N) and requires no user interaction (UI:N), with a scope-unchanged, availability-high outcome (A:H).
Know when Teamviewer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Crafted command needs adjacent-network reach (AV:A) but no auth or interaction (PR:N/UI:N); only the service crashes, so C:N/I:N/A:H, scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious actors to cause a denial of service (application crash) via a crafted command, resulting in service termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
More in Teamviewer
View allTeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. Rated high severity (CVSS
TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] a
An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. Rated medi
TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by sk
Command injection in TeamViewer Full Client and Host for Linux (prior to version 15.81.5) allows remote attackers to exe
Arbitrary code execution in TeamViewer DEX Client (formerly 1E Client) versions prior to 25.11 on Windows allows unauthe
TeamViewer Full Client and Host on Windows, Linux, and macOS contain an improper access control flaw that allows authent
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0.
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. Rate
Two-factor authentication bypass in TeamViewer Full Client and Host for macOS before 15.80 lets an already-authenticated
Heap-based buffer overflow in TeamViewer Full Client and Host for Linux and macOS before version 15.82 allows arbitrary
Local privilege escalation in TeamViewer Full Client and Host on Windows, Linux, and macOS (all versions prior to 15.82)
GitHub PoC
Exploit-DB