TeamViewer DEX CVE-2025-64991

Exploitation requires an authenticated account holding Actioner privileges within TeamViewer DEX (former 1E DEX) and the ability to submit the 1E-PatchInsights-Deploy instruction, which fails to properly validate input before building commands. It applies to versions prior to V15 of that instruction. Limiting factors: the attacker must already possess the privileged Actioner role (PR:H), so this is not exploitable by anonymous or low-privileged users; there is no public exploit and no evidence of active exploitation, and the elevated-command execution is confined to devices actually enrolled/connected to the DEX platform.

This is a legitimate but privilege-gated risk rather than a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) is internally consistent with the description: network-reachable, low complexity, no user interaction, but requiring high privileges (the description names 'Actioner privileges', which maps cleanly to PR:H). Full C/I/A compromise is credible because the flaw yields remote execution of elevated commands on managed endpoints. The EPSS score is low (0.87%, 58th percentile), and there is no CISA KEV listing and no public POC, so no public exploit identified at time of analysis - the signals are coherent (high technical impact but meaningful access barrier and no evidence of active exploitation). The main caveat: 'elevated commands on devices connected to the platform' implies the DEX actioner acts as a trusted command-distribution channel, so a compromised or malicious Actioner account effectively turns into endpoint-wide code execution (scope is scored S:U, but the real-world blast radius spans every connected device - defenders should weigh that even though CVSS keeps scope unchanged). No conflicting data was found; the vendor CVSS and description agree.

An attacker who already holds (or has compromised) a TeamViewer DEX account with Actioner privileges crafts a malicious 1E-PatchInsights-Deploy instruction whose input is not properly validated. The injected commands are then distributed and executed with elevated rights on the endpoints connected to the platform, giving the attacker fleet-wide code execution. No public exploit code is identified at time of analysis, and exploitation requires the privileged Actioner role.