CVE-2025-64993

HighCVSS 7.2/10Last modified Oct 8, 2026

Description

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-77

Affected software

Vendor	Product	Versions
TeamViewer	DEX	< 29
TeamViewer	DEX	< 29
TeamViewer	DEX	< 30
TeamViewer	DEX	< 29
TeamViewer	DEX	< 29
TeamViewer	DEX	< 29
TeamViewer	DEX	< 29
TeamViewer	DEX	< 29
TeamViewer	DEX	< 29
TeamViewer	DEX	< 29
TeamViewer	DEX	< 29

References

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/Vendor Advisory

Timeline

Published: Dec 11, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-649946.7A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruct CVE-2025-649956.7A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth CVE-2025-649964.4In Checkmk versions prior to 2.4.0p16, 2.3.0p41, and all versions of 2.2.0 and older, the mk_inotify plugin creates world-readable and writa CVE-2025-649976.5Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information v CVE-2025-649987.2Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabl CVE-2025-649995.4Improper neutralization of input in Checkmk versions 2.4.0 before 2.4.0p22, and 2.3.0 before 2.3.0p43 allows an attacker that can manipulate CVE-2025-65009.8A vulnerability, which was classified as critical, has been found in code-projects Inventory Management System 1.0. Affected by this issue i CVE-2025-650005.3SSH private keys of the "Remote alert handlers (Linux)" rule were exposed in the rule page's HTML source in Checkmk <= 2.4.0p18 and all vers CVE-2025-650018.2Fujitsu fbiosdrv.sys before 2.5.0.0 allows an attacker to potentially affect system confidentiality, integrity, and availability.CVE-2025-650027.5Fujitsu / Fsas Technologies iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is exactly 16 characters.CVE-2025-650078.7In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of authentication in the configuration change module in the ad CVE-2025-650089.4In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in the adm.cgi endpoint