TeamViewer DEX CVE-2025-64986

Exploitation requires an authenticated account with 'Actioner' privileges on the TeamViewer DEX (formerly 1E DEX) platform and targets the specific 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction in versions prior to V21. This is NOT remotely exploitable by an unauthenticated attacker - the PR:H metric confirms high privileges are required, which is the primary limiting factor and significantly narrows the attacker population to those already holding a privileged platform role. No user interaction is required (UI:N). The impact is amplified because successful injection executes elevated commands on downstream devices managed by the platform, so the blast radius depends on how many endpoints the DEX instance manages and how broadly the Actioner role is delegated.

This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 7.2 (HIGH) reflects a potent impact profile - network attack vector (AV:N), low complexity (AC:L), and full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) - but is gated by PR:H, meaning the attacker must already hold high privileges (specifically 'Actioner' role within the DEX platform). The EPSS score of 1.19% (67th percentile) indicates a low-to-modest exploitation probability, which is consistent with a privilege-gated, authenticated flaw rather than a mass-exploited internet-facing bug. There is no CISA KEV listing and no public exploit code identified in the provided data, so there is no evidence of active exploitation. The signals are internally consistent: a high-impact but high-privilege-required bug correctly yields a HIGH (not CRITICAL) score and low EPSS. The main caveat is trust-boundary dependent - the real risk hinges on how broadly the 'Actioner' privilege is granted in a given deployment and whether that role is considered trusted; where Actioner is widely assigned, this effectively becomes a privilege-escalation-to-RCE path across all managed endpoints. No SSVC decision data was provided in the input, so automatability and decision-point classification cannot be assessed.

An attacker who already holds (or has compromised an account with) 'Actioner' privileges on the TeamViewer DEX platform crafts malicious input to the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction, which fails to properly validate input. The injected commands are then executed with elevated privileges on the managed devices connected to the platform, converting platform-level access into remote code execution across the endpoint fleet. No public proof-of-concept exploit was identified at the time of analysis.