TeamViewer DEX CVE-2025-64993

Exploitation requires an authenticated account holding the 'Actioner' privilege within TeamViewer DEX (former 1E DEX) and reaching the 1E-ConfigMgrConsoleExtensions instructions feature, which fails to properly validate input (CWE-20). The high-privilege role (PR:H) is the key limiting factor: this is not exploitable by anonymous or low-privileged users, so realistic risk centers on malicious insiders or compromised Actioner credentials rather than opportunistic external attackers. Impact additionally depends on the platform being connected to and managing target devices, since the injected elevated commands execute on those connected endpoints.

This is a genuine but conditional risk rather than an urgent mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) describes a network-reachable, low-complexity flaw with no user interaction, but it explicitly requires PR:H - the attacker must already hold 'Actioner' privileges within TeamViewer DEX (former 1E DEX). This high-privilege precondition is the dominant risk-limiting signal and is consistent with the description, which names 'authenticated attackers with Actioner privileges.' The EPSS score of 0.87% (58th percentile) indicates low near-term probability of broad exploitation, there is no CISA KEV listing, and no public exploit code was identified, so exploitation status is 'no public exploit identified at time of analysis.' The signals are therefore internally consistent: a high technical impact (C:H/I:H/A:H, remote execution of elevated commands on managed endpoints) gated behind a privileged role, which tempers the real-world urgency. The primary residual concern is insider abuse or a compromised Actioner account being used to pivot command execution onto many connected devices. No signals conflict, but note that the only reference is the vendor bulletin - affected-version detail and exact fix are not independently corroborated here.

An attacker who already holds an Actioner role in the TeamViewer DEX console (an insider, or an adversary who has compromised such an account) crafts malicious input to the 1E-ConfigMgrConsoleExtensions instructions, where improper input validation allows command injection. Because the platform executes actions on connected endpoints, the injected commands run with elevated privileges on managed devices, enabling lateral code execution across the fleet. No public proof-of-concept was identified at the time of analysis.