TeamViewer DEX CVE-2025-64990

Requires an authenticated account holding 'Actioner' privileges on the TeamViewer DEX (former 1E DEX) platform, and a target running a version prior to V21.1 where the 1E-Explorer-TachyonCore-LogoffUser instruction performs improper input validation. Exploitation is performed by submitting that specific instruction with injected command content. Limiting factors: the privileged Actioner role is a significant barrier (this is not unauthenticated access), no user interaction is needed, and only pre-V21.1 deployments are vulnerable; the blast radius is amplified because injected commands execute with elevated privileges on endpoints connected to the platform.

This is a genuine but access-gated risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 HIGH) is driven by full C/I/A impact, but the PR:H requirement is the dominant limiter: the vendor description confirms the attacker must already hold 'Actioner' privileges, a privileged operational role within the TeamViewer DEX (former 1E DEX) platform. The EPSS score of 0.83% (56th percentile) is low-to-moderate and consistent with a privileged-access flaw that is not trivially mass-exploitable. The CVE is NOT on CISA KEV and no public exploit code was provided, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Signals are internally consistent - network vector plus high-privilege requirement plus moderate-low EPSS all point to a post-authentication privilege-leveraging issue, not an unauthenticated internet-facing wormable bug. The one point worth flagging for verification: the description states exploitation enables 'remote execution of elevated commands on devices connected to the platform,' which implies impact crossing from the DEX platform to managed endpoints (a scope-change / lateral-impact characteristic) even though the published vector records S:U - defenders should treat successful exploitation as capable of elevated command execution across managed fleet devices.

An attacker who has obtained or abused an account with Actioner privileges on the TeamViewer DEX platform submits a crafted 1E-Explorer-TachyonCore-LogoffUser instruction (on versions prior to V21.1) containing injected command syntax that improper input validation fails to sanitize. Because the platform dispatches instructions to managed endpoints, the injected commands execute with elevated privileges on connected devices, giving the attacker arbitrary command execution across the managed fleet. No public exploit code was identified at time of analysis, and the attack requires the high-privilege Actioner role rather than anonymous access.