PT-2025-50595 · 1E+1 · 1E Dex+1

Published 2025-12-11 · Updated 2025-12-11 · CVE-2025-64988

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TeamViewer DEX (former 1E DEX) versions prior to V19.2

Description A command injection issue exists in TeamViewer DEX (formerly 1E DEX) due to improper input validation. The vulnerability is located within the 1E-Nomad-GetCmContentLocations instruction. Authenticated attackers with Actioner privileges can inject arbitrary commands, leading to remote execution of elevated commands on connected devices.

Recommendations Update to version V19.2 or later.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-20

CWE-77

Related Identifiers

CVE-2025-64988

Affected Products

1E Dex

Teamviewer Dex

References · 6

• https://osv.dev/vulnerability/CVE-2025-64988 · Vendor Advisory
• https://teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64988 · Security Note
• https://twitter.com/VulmonFeeds/status/1999122361182818705 · Twitter Post
• https://twitter.com/CVEnew/status/1999108854970564693 · Twitter Post
• https://t.me/CVEtracker/39472 · Telegram Post