TeamViewer DEX CVE-2025-64987

Exploitation requires an authenticated account holding the 'Actioner' role within the TeamViewer DEX (former 1E DEX) platform, and the attack targets the specific 1E-Explorer-TachyonCore-CheckSimpleIoC instruction, whose improper input validation (CWE-20) permits command injection. The platform must have managed/connected devices for the elevated commands to execute against. Limiting factors: the required privileged application role (PR:H) excludes anonymous or low-privilege users, no user interaction by a victim is needed (UI:N), and no public exploit code exists, so an attacker must both obtain the privileged role and author the injection payload. This bounds realistic risk to malicious insiders or adversaries who have already gained a privileged operator foothold.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, score 7.2) describes a network-reachable, low-complexity flaw that nonetheless requires authenticated access at a privileged role level - the description specifies 'Actioner privileges', an application role within the TeamViewer DEX (former 1E DEX) platform, which materially constrains the attacker population to insiders or anyone who has already compromised a privileged operator account. Impact is severe (C:H/I:H/A:H) because successful injection yields remote execution of elevated commands on managed endpoints connected to the platform. Exploitation signals are modest and consistent with each other: EPSS is 1.16% (66th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or widespread exploitation. No SSVC decision data was provided in the input. One point to verify with the vendor: the CVSS carries S:U (unchanged scope), yet the described effect - a platform-role user causing command execution on separate downstream managed devices - arguably crosses a security authority boundary (scope change), which would raise the real-world severity; see assessed vectors below.

An attacker who already holds (or has phished/compromised) a TeamViewer DEX account with the Actioner role submits a crafted 1E-Explorer-TachyonCore-CheckSimpleIoC instruction whose input is not properly validated, smuggling shell metacharacters or extra commands into the executed payload. The platform then relays and runs these elevated commands on the endpoints it manages, giving the attacker arbitrary code execution across connected devices. No public proof-of-concept is known, so an attacker would need to develop the injection payload themselves.