TeamViewer DEX CVE-2025-64988

Requires an authenticated account with the 'Actioner' privilege on a TeamViewer/1E DEX deployment running a version prior to V19.2, and the attack specifically targets the 1E-Nomad-GetCmContentLocations instruction, which fails to properly validate input (CWE-20). Limiting factors: the Actioner role is a non-default, elevated privilege (PR:H), so exploitation depends on insider access or credential compromise rather than anonymous reach; patched/V19.2+ instances and deployments that tightly restrict Actioner assignment are not exploitable. No end-user interaction is required (UI:N).

Signals are moderately consistent and point to a real but gated threat rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:H) yields 7.2 (High) and correctly reflects the core constraint: exploitation requires high privileges - specifically an authenticated account holding the 'Actioner' role (PR:H) - while impact is total command execution. EPSS is 1.16% (66th percentile), which is low-to-moderate and consistent with the privilege barrier; there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is not confirmed in-the-wild exploitation. Net: this is a legitimate priority for organizations running TeamViewer/1E DEX because a trusted-but-not-admin insider or a compromised Actioner credential converts directly into elevated code execution on managed endpoints, but it is not a mass-exploitation, high-velocity issue. One notable tension to verify: the description states impact is 'remote execution of elevated commands on devices connected to the platform,' which implies the compromise crosses from the DEX platform to separately-managed endpoints - a scope change that the vendor's S:U (unchanged) scope arguably understates; defenders should treat blast radius as platform-wide across managed fleets regardless of the S:U label.

An authenticated user (or an attacker who has phished/stolen the credentials) holding the Actioner privilege submits crafted input to the 1E-Nomad-GetCmContentLocations instruction on a TeamViewer/1E DEX instance prior to V19.2. Because input validation is improper, the attacker injects arbitrary OS commands that the platform executes with elevated privileges on connected managed devices. No public exploit code is identified at time of analysis, and network-reachable, low-complexity delivery (AV:N/AC:L) means a single valid Actioner session is enough to pivot into fleet-wide command execution.