TeamViewer DEX CVE-2025-64989

Exploitation requires an authenticated account with Actioner privileges on the TeamViewer DEX (former 1E DEX) platform and the ability to invoke the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction, whose parameter input is improperly validated (CWE-20) in versions prior to V21.1. Limiting factors: the attacker must already hold this elevated management role (PR:H), so unprivileged or external unauthenticated users cannot trigger it; the environment must be running a pre-V21.1 build; and the high-impact outcome depends on the platform having managed/connected devices to dispatch the injected commands to. No user interaction is required (UI:N).

This is a moderate-priority issue rather than a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2 High) describes a network-reachable, low-complexity flaw that nonetheless requires high privileges - specifically an authenticated account holding 'Actioner' privileges in the TeamViewer DEX (former 1E DEX) platform. That PR:H requirement is the single largest risk reducer: an attacker must already be a trusted, privileged operator of the management console, so this is primarily an insider-abuse / privilege-boundary violation or a post-compromise escalation vector, not an open-internet unauthenticated RCE. EPSS of 1.10% (65th percentile) is low-to-moderate and aligns with that gating - no broad, automatable mass-exploitation is predicted. The vulnerability is NOT listed in CISA KEV and there is no public exploit identified at time of analysis, so there is currently no evidence of active exploitation or weaponization. The genuinely elevated factor is impact: C:H/I:H/A:H plus the description's statement that exploitation yields 'remote execution of elevated commands on devices connected to the platform,' meaning a single abused Actioner account can push arbitrary elevated commands across a fleet of managed endpoints - a severe downstream blast radius. Note a scope consideration: NVD scored this S:U, but the stated impact crosses from the DEX core to managed endpoint devices, which arguably warrants a scope change - see confidence_notes. No SSVC decision data was provided in the input, so exploitation/automatable/technical-impact determinations could not be independently corroborated.

A malicious or compromised DEX operator holding Actioner privileges invokes the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction and injects crafted command syntax into an improperly validated parameter. Because the instruction is dispatched to managed endpoints, the injected commands execute with elevated privileges across devices connected to the platform, giving the attacker fleet-wide arbitrary command execution. No public exploit code has been identified, so exploitation currently requires the attacker to craft the injection themselves.