PT-2026-5258 · Teamviewer+1 · Teamviewer Dex+1

Published 2026-01-29 · Updated 2026-02-11 · CVE-2026-23571

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TeamViewer DEX (former 1E DEX) versions prior to 24.5

Description A command injection issue exists in TeamViewer DEX (formerly 1E DEX) related to the 1E-Nomad-RunPkgStatusRequest instruction. Insufficient input validation allows attackers with actioner privileges to execute arbitrary commands with elevated permissions on connected hosts by injecting malicious commands into the input field of the instruction.

Recommendations Update to version 24.5 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-23571

Affected Products

1E Dex

Teamviewer Dex

References · 6

• https://osv.dev/vulnerability/CVE-2026-23571 · Vendor Advisory
• https://teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23571 · Security Note
• https://t.me/cveNotify/151760 · Telegram Post
• https://t.me/CVEtracker/43227 · Telegram Post
• https://twitter.com/CVEnew/status/2016805045501886728 · Twitter Post