TeamViewer DEX CVE-2025-64994

Exploitation requires local access to a device running an affected TeamViewer DEX (former 1E DEX) version prior to V17.1, plus pre-existing write access to a directory that appears in the system PATH. The 1E-Nomad-SetWorkRate instruction resolves executables through an uncontrolled/untrusted search path (CWE-427), so a binary planted in such a directory is executed as SYSTEM. Limiting factors: no remote vector (AV:L), no user interaction needed (UI:N), only versions before V17.1 are affected, and the attacker must already hold the privileges needed to write into a PATH directory (vendor-rated PR:H) - on correctly configured systems this is normally an administrative capability, which significantly constrains who can exploit it.

This is a moderate, locally-exploitable privilege-escalation issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 6.7 Medium) requires local access and already-elevated privileges (PR:H), which sharply limits reach, even though the technical impact is full SYSTEM compromise (C:H/I:H/A:H). All exploitation signals point the same direction: EPSS is very low (0.18%, 7th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are consistent (low EPSS + no KEV + high privilege requirement all indicate low real-world urgency), with no conflicts to flag. Note one nuance worth verifying with the vendor: the description frames this as escalation by a 'local attacker with write access to a PATH directory,' yet the vendor scored PR:H - on a well-configured host, write access to a PATH directory normally already requires administrative rights, so the practical gain is admin→SYSTEM; the scenario becomes more dangerous only where a lower-privileged user has write access to a misconfigured PATH directory. Priority should be routine patching to V17.1, not emergency response.

A local user (or attacker who has already gained a foothold) with write access to a directory listed in the system PATH plants a malicious executable matching a name the 1E-Nomad-SetWorkRate instruction resolves via its uncontrolled search path. When the DEX/Nomad component runs that instruction, it loads and executes the attacker's binary in the SYSTEM context, yielding full local compromise. No public proof-of-concept exploit is referenced in the available data.