PT-2025-50593 · 1E+1 · 1E Dex+1

Published 2025-12-11 · Updated 2025-12-11 · CVE-2025-64986

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TeamViewer DEX (former 1E DEX) versions prior to 21

Description A command injection issue exists in TeamViewer DEX (formerly 1E DEX). The vulnerability is located within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction. Insufficient input validation allows authenticated attackers possessing Actioner privileges to inject arbitrary commands. Successful exploitation allows for the remote execution of elevated commands on devices connected to the platform.

Recommendations Update to version 21 or later.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-20

CWE-77

Related Identifiers

CVE-2025-64986

Affected Products

1E Dex

Teamviewer Dex

References · 5

• https://osv.dev/vulnerability/CVE-2025-64986 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64986 · Security Note
• https://teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006 · Vendor Advisory
• https://t.me/CVEtracker/39470 · Telegram Post
• https://twitter.com/CVEnew/status/1999108858388857218 · Twitter Post