PT-2025-50596 · 1E+1 · 1E Dex+1

Published 2025-12-11 · Updated 2025-12-11 · CVE-2025-64989

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TeamViewer DEX versions prior to 21.1

Description A command injection issue exists in TeamViewer DEX (formerly 1E DEX) within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction. Insufficient input validation allows authenticated attackers possessing Actioner privileges to inject arbitrary commands. Successful exploitation allows for the remote execution of elevated commands on connected devices.

Recommendations Update TeamViewer DEX to version 21.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-64989

Affected Products

1E Dex

Teamviewer Dex

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-64989 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64989 · Vendor Advisory
• https://teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006 · Vendor Advisory
• https://t.me/CVEtracker/39473 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1999119801164149221 · Twitter Post
• https://twitter.com/CVEnew/status/1999108853661934012 · Twitter Post