TeamViewer DEX CVE-2025-64992

Requires an authenticated account holding 'Actioner' privileges on the TeamViewer DEX (former 1E DEX) platform, and specifically the ability to invoke the 1E-Nomad-PauseNomadJobQueue instruction, which fails to properly validate input. Only versions prior to V25 are affected. The principal limiting factor is the high-privilege Actioner role (PR:H) - this is not remotely exploitable by an unauthenticated attacker, so realistic exploitation hinges on a malicious privileged insider or a compromised/stolen Actioner credential rather than opportunistic external attack.

This is a moderate-priority issue whose severity is tempered by a meaningful access barrier. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 HIGH) describes network-reachable, low-complexity exploitation with no user interaction but requiring high privileges (PR:H) - consistent with the description's statement that an attacker must already hold 'Actioner' privileges within the platform. The signals point toward a lower-urgency profile than the HIGH rating alone suggests: EPSS is only 0.87% (58th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit code has been identified. No SSVC decision data was provided. The key tension is privilege: because exploitation presupposes an authenticated, privileged insider or a compromised Actioner account, real-world risk is dominated by insider-threat and account-takeover scenarios rather than opportunistic mass exploitation - which aligns with the modest EPSS. One divergence worth flagging to the vendor: the description says exploitation yields 'remote execution of elevated commands on devices connected to the platform,' which implies impact crossing from the DEX platform into managed endpoints (a scope change), yet the published vector uses S:U - verify whether S:C is more appropriate, as it would materially raise the score.

An attacker who has obtained an authenticated account with Actioner privileges on the TeamViewer DEX (formerly 1E DEX) platform - whether a malicious insider or via credential theft - submits a crafted input to the 1E-Nomad-PauseNomadJobQueue instruction. Due to improper input validation, the input is interpreted as shell commands, which are then executed with elevated privileges on endpoints connected to the platform. No public proof-of-concept or exploit code has been identified at the time of analysis.