Digital Employee Experience
Monthly
TeamViewer DEX versions below 24.5 allow authenticated users with actioner privileges to execute arbitrary elevated commands on connected hosts through inadequate input validation in the 1E-Nomad-RunPkgStatusRequest instruction. An attacker with these credentials could inject malicious commands to gain unauthorized system access and control. The vulnerability requires user interaction and high-level privileges but carries a significant risk due to the potential for complete system compromise.
Log timestamp tampering in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to inject malicious UDP Sync commands that corrupt event timestamps, undermining log integrity and forensic investigation capabilities. This input validation flaw affects Windows deployments of the NomadBranch service and could enable attackers to obscure the timeline of malicious activities or create misleading audit trails. No patch is currently available for this medium-severity vulnerability.
TeamViewer DEX Client versions before 26.1 contain an out-of-bounds read in the Content Distribution Service that enables remote attackers to leak stack memory and trigger denial of service without authentication. Successful exploitation could disclose memory contents useful for bypassing address space layout randomization and chaining with other vulnerabilities. No patch is currently available for this medium-severity flaw affecting Windows deployments.
Information disclosure and denial-of-service in TeamViewer DEX Client versions before 26.1 allows adjacent network attackers to trigger an out-of-bounds read via specially crafted packets, potentially leaking sensitive memory that could be leveraged to bypass ASLR protections. Affected Windows systems running the NomadBranch.exe content distribution service are vulnerable to attacks requiring only network proximity, with no authentication or user interaction needed.
Denial-of-service in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to crash the NomadBranch.exe service by sending specially crafted UDP packets that trigger a heap buffer overflow. The vulnerability stems from an integer underflow in the UDP command handler that can be exploited without authentication or user interaction. Currently, no patch is available and the attack requires network adjacency to the affected system.
Log tampering in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to inject, modify, or forge entries in the NomadBranch.log file through the UDP network handler, compromising log integrity and audit trail reliability. An attacker with network access can send crafted packets to the Content Distribution Service to manipulate logging records without authentication, potentially obscuring malicious activity or creating false audit entries.
TeamViewer DEX Client versions prior to 26.1 contain a null pointer dereference in the NomadBranch.exe Content Distribution Service that allows adjacent network attackers to crash the process without authentication. An attacker can exploit this vulnerability to disable the Content Distribution Service, causing a denial-of-service condition on affected Windows systems. No patch is currently available.
Digital Employee Experience is affected by cleartext transmission of sensitive information (CVSS 6.5).
Digital Employee Experience versions up to 26.1 is affected by improper link resolution before file access (CVSS 5.7).
Local privilege escalation in TeamViewer DEX (formerly 1E DEX) prior to V3.4 lets an attacker who already has local access to a Windows endpoint hijack the execution path used by the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction and run arbitrary code as SYSTEM. Exploitation requires pre-existing local access to the device, the ability to write to the path from which the vulnerable instruction loads its executable, and timing the hijack while that instruction runs; the vendor-assigned CVSS is 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) although our independent assessment lowers the privilege prerequisite to PR:L (CVSS 6.7 as well). No public exploit code has been identified at time of analysis, KEV does not list this CVE, and EPSS is low at 0.17% (5th percentile), making this a conditional local escalation rather than an internet-facing emergency.
Local privilege escalation in TeamViewer DEX (formerly 1E DEX) versions prior to V17.1 lets an attacker who already holds write access to a directory listed in the system PATH plant a malicious executable that the 1E-Nomad-SetWorkRate instruction resolves and runs with SYSTEM privileges. The root cause is an uncontrolled search path (CWE-427), so exploitation is local, requires no user interaction, and is gated by high-privilege pre-conditions (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7) - on a well-configured host the required write access is itself an administrative capability, which substantially limits the realistic attack surface. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.18% (7th percentile), making this a moderate post-access escalation rather than an emergency.
Command injection in TeamViewer DEX (formerly 1E DEX) allows an authenticated attacker with the Actioner privilege to execute arbitrary elevated commands on managed devices via the 1E-ConfigMgrConsoleExtensions instructions feature. The vulnerability arises from improper input validation (CWE-20) and carries a CVSS 3.1 score of 7.2 with a changed scope per independent assessment, but the high-privilege requirement (PR:H) makes it a conditional risk rather than an urgent mass-exploitation threat. EPSS is low at 0.87% (58th percentile), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Command injection in TeamViewer DEX (formerly 1E DEX) versions prior to V25 allows an authenticated user holding 'Actioner' privileges to inject arbitrary commands through the 1E-Nomad-PauseNomadJobQueue instruction, resulting in remote execution of elevated commands on devices connected to the platform. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the assessed vector raises scope to Changed (S:C); the dominant mitigating factor is the high-privilege Actioner role required, meaning this is not exploitable by an unauthenticated attacker and realistic risk comes from a malicious privileged insider or a compromised/stolen Actioner credential. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is 0.87% (58th percentile), consistent with a moderate-priority issue whose severity is tempered by a meaningful access barrier.
Command injection in TeamViewer DEX (formerly 1E DEX) lets an authenticated user with Actioner privileges run arbitrary elevated commands on managed devices by submitting crafted input to the 1E-PatchInsights-Deploy instruction prior to V15. The issue is rooted in improper input validation (CWE-20) and carries a CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation is privilege-gated. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV absent); EPSS is 0.87% (58th percentile).
Command injection in TeamViewer DEX (formerly 1E DEX) versions prior to V21.1 allows an authenticated user with Actioner privileges to execute arbitrary elevated commands on managed endpoints by submitting a crafted 1E-Explorer-TachyonCore-LogoffUser instruction. The flaw is an improper input validation issue (CWE-20) in the instruction handling path, and exploitation requires network reachability to the DEX platform plus a high-privileged Actioner account, so it is access-gated rather than unauthenticated. No public exploit identified at time of analysis; EPSS is 0.83% (56th percentile) and there is no CISA KEV listing, making this a genuine but access-gated risk rather than a drop-everything emergency.
Command injection in TeamViewer DEX (formerly 1E DEX) versions prior to V21.1 allows an authenticated attacker with Actioner privileges to execute arbitrary elevated commands on managed devices via the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction. The flaw is due to improper input validation (CWE-20), and exploitation requires high privileges (PR:H) but no user interaction. No public exploit code has been identified, and the EPSS score is 1.10% (65th percentile); our independent assessment rates this as a moderate-priority issue, consistent with the need for an elevated management role and connected devices to target.
Command injection in TeamViewer DEX (formerly 1E DEX) allows an authenticated user holding the elevated 'Actioner' privilege to execute arbitrary, elevated commands on endpoints managed by the platform, via the 1E-Nomad-GetCmContentLocations instruction in versions prior to V19.2. The flaw is an improper input validation issue (CWE-20) reachable over the network with no user interaction, but it is gated behind a high-privilege role (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation requires insider access or compromise of an Actioner account rather than anonymous access. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); EPSS is 1.16% (66th percentile), a moderate score consistent with a real but credential-gated threat. Vendor-released patch: V19.2.
Command injection in the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction of TeamViewer DEX (formerly 1E DEX) allows an authenticated operator holding the Actioner role to execute arbitrary elevated commands on devices managed through the platform. Because the required role is a privileged application role, realistic risk is bounded to malicious insiders or adversaries who already hold a high-privilege operator foothold; no public exploit code and no CISA KEV activity were identified at time of analysis, and the EPSS score of 1.16% (66th percentile) indicates low observed exploitation likelihood. Patch guidance is published in TeamViewer security bulletin TV-2025-1006.
Command injection in TeamViewer DEX (formerly 1E DEX) allows authenticated attackers with Actioner privileges to execute arbitrary elevated commands on managed devices via the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction in versions prior to V21. The vulnerability requires high privileges (PR:H), so it is not exploitable by unauthenticated remote attackers, and no public exploit identified at time of analysis; EPSS is 1.19% (67th percentile). This is a moderate-priority issue rather than an emergency, with impact limited to environments where the Actioner role is broadly delegated.
Information disclosure in TeamViewer DEX Client (formerly 1E Client) prior to version 25.11 for Windows lets an attacker positioned on the same adjacent network segment coerce the NomadBranch.exe Content Distribution Service into sending data to an arbitrary internal IP address. No authentication or user interaction is required once network adjacency is achieved, and the CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confines impact to confidentiality with no integrity or availability effect, giving a base score of 6.5. Exploitation is not confirmed as active (no CISA KEV listing), no public exploit code has been identified at time of analysis, and EPSS is a low 0.20% (9th percentile); the operative barriers are the mandatory adjacent-network foothold, the presence of the vulnerable function on a pre-25.11 build, and exposure of the content-distribution service.
Arbitrary code execution in TeamViewer DEX Client (formerly 1E Client) versions prior to 25.11 on Windows allows unauthenticated attackers on an adjacent network to bypass file integrity validation by supplying a valid hash for a malicious file. The Content Distribution Service (NomadBranch.exe) then incorrectly trusts and processes the file, executing code in the service context. No public exploit code has been identified, and the EPSS score is low (0.30%), but the CVSS base score of 8.8 reflects high impact to confidentiality, integrity, and availability. This is a moderately high-priority vulnerability but not an emergency.
Denial of service in TeamViewer DEX Client (formerly 1E Client) for Windows prior to version 25.11 lets an unauthenticated attacker who is already on the same adjacent network segment crash the Content Distribution Service (NomadBranch.exe) with a crafted command, terminating the service process. Impact is limited to availability (CVSS 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - there is no confidentiality or integrity effect and the service can be restarted on the host - so exploitation is only possible laterally from the local network and not from the internet, and hosts on 25.11 or later are unaffected. There is no public exploit identified at time of analysis and no KEV listing; EPSS is low at 0.21% (11th percentile), consistent with a moderate, availability-only issue of limited real-world urgency.
TeamViewer DEX versions below 24.5 allow authenticated users with actioner privileges to execute arbitrary elevated commands on connected hosts through inadequate input validation in the 1E-Nomad-RunPkgStatusRequest instruction. An attacker with these credentials could inject malicious commands to gain unauthorized system access and control. The vulnerability requires user interaction and high-level privileges but carries a significant risk due to the potential for complete system compromise.
Log timestamp tampering in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to inject malicious UDP Sync commands that corrupt event timestamps, undermining log integrity and forensic investigation capabilities. This input validation flaw affects Windows deployments of the NomadBranch service and could enable attackers to obscure the timeline of malicious activities or create misleading audit trails. No patch is currently available for this medium-severity vulnerability.
TeamViewer DEX Client versions before 26.1 contain an out-of-bounds read in the Content Distribution Service that enables remote attackers to leak stack memory and trigger denial of service without authentication. Successful exploitation could disclose memory contents useful for bypassing address space layout randomization and chaining with other vulnerabilities. No patch is currently available for this medium-severity flaw affecting Windows deployments.
Information disclosure and denial-of-service in TeamViewer DEX Client versions before 26.1 allows adjacent network attackers to trigger an out-of-bounds read via specially crafted packets, potentially leaking sensitive memory that could be leveraged to bypass ASLR protections. Affected Windows systems running the NomadBranch.exe content distribution service are vulnerable to attacks requiring only network proximity, with no authentication or user interaction needed.
Denial-of-service in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to crash the NomadBranch.exe service by sending specially crafted UDP packets that trigger a heap buffer overflow. The vulnerability stems from an integer underflow in the UDP command handler that can be exploited without authentication or user interaction. Currently, no patch is available and the attack requires network adjacency to the affected system.
Log tampering in TeamViewer DEX Client versions prior to 26.1 allows adjacent network attackers to inject, modify, or forge entries in the NomadBranch.log file through the UDP network handler, compromising log integrity and audit trail reliability. An attacker with network access can send crafted packets to the Content Distribution Service to manipulate logging records without authentication, potentially obscuring malicious activity or creating false audit entries.
TeamViewer DEX Client versions prior to 26.1 contain a null pointer dereference in the NomadBranch.exe Content Distribution Service that allows adjacent network attackers to crash the process without authentication. An attacker can exploit this vulnerability to disable the Content Distribution Service, causing a denial-of-service condition on affected Windows systems. No patch is currently available.
Digital Employee Experience is affected by cleartext transmission of sensitive information (CVSS 6.5).
Digital Employee Experience versions up to 26.1 is affected by improper link resolution before file access (CVSS 5.7).
Local privilege escalation in TeamViewer DEX (formerly 1E DEX) prior to V3.4 lets an attacker who already has local access to a Windows endpoint hijack the execution path used by the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction and run arbitrary code as SYSTEM. Exploitation requires pre-existing local access to the device, the ability to write to the path from which the vulnerable instruction loads its executable, and timing the hijack while that instruction runs; the vendor-assigned CVSS is 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) although our independent assessment lowers the privilege prerequisite to PR:L (CVSS 6.7 as well). No public exploit code has been identified at time of analysis, KEV does not list this CVE, and EPSS is low at 0.17% (5th percentile), making this a conditional local escalation rather than an internet-facing emergency.
Local privilege escalation in TeamViewer DEX (formerly 1E DEX) versions prior to V17.1 lets an attacker who already holds write access to a directory listed in the system PATH plant a malicious executable that the 1E-Nomad-SetWorkRate instruction resolves and runs with SYSTEM privileges. The root cause is an uncontrolled search path (CWE-427), so exploitation is local, requires no user interaction, and is gated by high-privilege pre-conditions (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7) - on a well-configured host the required write access is itself an administrative capability, which substantially limits the realistic attack surface. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.18% (7th percentile), making this a moderate post-access escalation rather than an emergency.
Command injection in TeamViewer DEX (formerly 1E DEX) allows an authenticated attacker with the Actioner privilege to execute arbitrary elevated commands on managed devices via the 1E-ConfigMgrConsoleExtensions instructions feature. The vulnerability arises from improper input validation (CWE-20) and carries a CVSS 3.1 score of 7.2 with a changed scope per independent assessment, but the high-privilege requirement (PR:H) makes it a conditional risk rather than an urgent mass-exploitation threat. EPSS is low at 0.87% (58th percentile), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Command injection in TeamViewer DEX (formerly 1E DEX) versions prior to V25 allows an authenticated user holding 'Actioner' privileges to inject arbitrary commands through the 1E-Nomad-PauseNomadJobQueue instruction, resulting in remote execution of elevated commands on devices connected to the platform. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the assessed vector raises scope to Changed (S:C); the dominant mitigating factor is the high-privilege Actioner role required, meaning this is not exploitable by an unauthenticated attacker and realistic risk comes from a malicious privileged insider or a compromised/stolen Actioner credential. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is 0.87% (58th percentile), consistent with a moderate-priority issue whose severity is tempered by a meaningful access barrier.
Command injection in TeamViewer DEX (formerly 1E DEX) lets an authenticated user with Actioner privileges run arbitrary elevated commands on managed devices by submitting crafted input to the 1E-PatchInsights-Deploy instruction prior to V15. The issue is rooted in improper input validation (CWE-20) and carries a CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation is privilege-gated. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV absent); EPSS is 0.87% (58th percentile).
Command injection in TeamViewer DEX (formerly 1E DEX) versions prior to V21.1 allows an authenticated user with Actioner privileges to execute arbitrary elevated commands on managed endpoints by submitting a crafted 1E-Explorer-TachyonCore-LogoffUser instruction. The flaw is an improper input validation issue (CWE-20) in the instruction handling path, and exploitation requires network reachability to the DEX platform plus a high-privileged Actioner account, so it is access-gated rather than unauthenticated. No public exploit identified at time of analysis; EPSS is 0.83% (56th percentile) and there is no CISA KEV listing, making this a genuine but access-gated risk rather than a drop-everything emergency.
Command injection in TeamViewer DEX (formerly 1E DEX) versions prior to V21.1 allows an authenticated attacker with Actioner privileges to execute arbitrary elevated commands on managed devices via the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction. The flaw is due to improper input validation (CWE-20), and exploitation requires high privileges (PR:H) but no user interaction. No public exploit code has been identified, and the EPSS score is 1.10% (65th percentile); our independent assessment rates this as a moderate-priority issue, consistent with the need for an elevated management role and connected devices to target.
Command injection in TeamViewer DEX (formerly 1E DEX) allows an authenticated user holding the elevated 'Actioner' privilege to execute arbitrary, elevated commands on endpoints managed by the platform, via the 1E-Nomad-GetCmContentLocations instruction in versions prior to V19.2. The flaw is an improper input validation issue (CWE-20) reachable over the network with no user interaction, but it is gated behind a high-privilege role (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so exploitation requires insider access or compromise of an Actioner account rather than anonymous access. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); EPSS is 1.16% (66th percentile), a moderate score consistent with a real but credential-gated threat. Vendor-released patch: V19.2.
Command injection in the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction of TeamViewer DEX (formerly 1E DEX) allows an authenticated operator holding the Actioner role to execute arbitrary elevated commands on devices managed through the platform. Because the required role is a privileged application role, realistic risk is bounded to malicious insiders or adversaries who already hold a high-privilege operator foothold; no public exploit code and no CISA KEV activity were identified at time of analysis, and the EPSS score of 1.16% (66th percentile) indicates low observed exploitation likelihood. Patch guidance is published in TeamViewer security bulletin TV-2025-1006.
Command injection in TeamViewer DEX (formerly 1E DEX) allows authenticated attackers with Actioner privileges to execute arbitrary elevated commands on managed devices via the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction in versions prior to V21. The vulnerability requires high privileges (PR:H), so it is not exploitable by unauthenticated remote attackers, and no public exploit identified at time of analysis; EPSS is 1.19% (67th percentile). This is a moderate-priority issue rather than an emergency, with impact limited to environments where the Actioner role is broadly delegated.
Information disclosure in TeamViewer DEX Client (formerly 1E Client) prior to version 25.11 for Windows lets an attacker positioned on the same adjacent network segment coerce the NomadBranch.exe Content Distribution Service into sending data to an arbitrary internal IP address. No authentication or user interaction is required once network adjacency is achieved, and the CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confines impact to confidentiality with no integrity or availability effect, giving a base score of 6.5. Exploitation is not confirmed as active (no CISA KEV listing), no public exploit code has been identified at time of analysis, and EPSS is a low 0.20% (9th percentile); the operative barriers are the mandatory adjacent-network foothold, the presence of the vulnerable function on a pre-25.11 build, and exposure of the content-distribution service.
Arbitrary code execution in TeamViewer DEX Client (formerly 1E Client) versions prior to 25.11 on Windows allows unauthenticated attackers on an adjacent network to bypass file integrity validation by supplying a valid hash for a malicious file. The Content Distribution Service (NomadBranch.exe) then incorrectly trusts and processes the file, executing code in the service context. No public exploit code has been identified, and the EPSS score is low (0.30%), but the CVSS base score of 8.8 reflects high impact to confidentiality, integrity, and availability. This is a moderately high-priority vulnerability but not an emergency.
Denial of service in TeamViewer DEX Client (formerly 1E Client) for Windows prior to version 25.11 lets an unauthenticated attacker who is already on the same adjacent network segment crash the Content Distribution Service (NomadBranch.exe) with a crafted command, terminating the service process. Impact is limited to availability (CVSS 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - there is no confidentiality or integrity effect and the service can be restarted on the host - so exploitation is only possible laterally from the local network and not from the internet, and hosts on 25.11 or later are unaffected. There is no public exploit identified at time of analysis and no KEV listing; EPSS is low at 0.21% (11th percentile), consistent with a moderate, availability-only issue of limited real-world urgency.