TeamViewer DEX Client CVE-2025-46266

Exploitation requires a running TeamViewer DEX Client (former 1E Client) Content Distribution Service - specifically NomadBranch.exe - on a Windows host at a version prior to 25.11. Per the CVSS vector (AV:A), the attacker must be positioned on the same adjacent/local network segment as the target service; it is NOT exploitable from the arbitrary internet. No authentication (PR:N) and no user interaction (UI:N) are needed once adjacency is achieved. The limiting factors are therefore: mandatory adjacent-network access, presence of the vulnerable NomadBranch content-distribution component, and a pre-25.11 build; impact is confined to confidentiality (data leakage to an arbitrary internal IP) with no integrity or availability effect.

This is a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 6.5) tells a consistent story: exploitation requires adjacent-network positioning (AV:A), not full internet reachability, but no authentication (PR:N) and no user interaction (UI:N), with high confidentiality impact and zero integrity/availability impact - matching the description of an information-disclosure/SSRF-style flaw where the NomadBranch.exe content distribution service can be coerced into sending data to an arbitrary internal IP. The exploitation signals all point LOW: EPSS is 0.20% (9th percentile), the vulnerability is NOT on CISA KEV, and no public exploit code was identified in the provided data, so there is no evidence of active or imminent mass exploitation. No SSVC decision data was provided in the input, so an automatable/exploitation-status framework assessment cannot be rendered. The signals are internally consistent (low EPSS, no KEV, no POC, adjacent-only vector all agree this is low real-world risk today); the main caveat is that the description's confidentiality/SSRF-style impact depends on what internal data the service holds or can relay, which the advisory does not quantify. Net: patch in normal cycle for affected enterprise endpoints, prioritizing segments where the adjacent-network precondition is easily met, but this is not an emergency.

An attacker with a foothold on the same local/adjacent network segment as a Windows host running the TeamViewer DEX / former 1E Client Content Distribution Service (NomadBranch.exe) sends crafted input that coerces the unauthenticated service into transmitting data to an attacker-designated internal IP address, enabling disclosure of sensitive information or internal reconnaissance. No authentication or user interaction is required (PR:N/UI:N), but the attacker must already be adjacent to the target (AV:A). No public exploit code was identified at time of analysis.