TeamViewer DEX EUVD-2026-31420

Exploitation requires a valid, authenticated user account on the targeted TeamViewer DEX (On-Premises) instance assigned a low-privilege role - administrative credentials are not needed. The target system must be running any version below 9.2. The attack is conducted over the network (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N). The primary limiting factor is PR:L: the attacker must already possess valid platform credentials, which eliminates unauthenticated external threat actors. The vulnerability is scoped explicitly to on-premises deployments; cloud-hosted variants are not referenced in available data. No specific non-default configuration is required - the authorization flaw is present in a standard deployment of affected versions.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N yields a score of 5.4 (Medium). Attack vector is Network and complexity is Low with no user interaction required, meaning exploitation is technically straightforward once credentials are held. The PR:L (low privilege required) is the primary limiting factor, ruling out unauthenticated external attackers. Scope is Unchanged (S:U), indicating the vulnerability does not break out of the affected component's security context, and both Confidentiality and Integrity impacts are rated Low - suggesting partial unauthorized read/write access rather than full administrative takeover. No EPSS data was provided in the source intelligence, so exploitation probability cannot be quantified numerically. No CISA KEV listing exists, meaning widespread active exploitation has not been confirmed by a government-tier source. Taken together, this is a moderate real-world priority: lower urgency than a pre-auth critical, but elevated in environments with large user populations, shared credentials, or insider-threat exposure models.

An attacker holding any valid low-privileged account on an unpatched TeamViewer DEX On-Premises instance crafts authenticated HTTP requests directly targeting administrative or sensitive backend API endpoints that omit authorization checks. Because the flaw requires only a standard user credential and no special platform configuration, the attacker can enumerate and invoke privileged operations - such as reading sensitive user records or modifying platform configuration - that are intended to be restricted to administrative roles. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity (AC:L) means exploitation requires minimal technical sophistication beyond knowledge of the affected endpoint paths.