Vulnerability · Published Dec 11, 2025 · Assigned by TV

CVE-2025-64989Command Injection in 1E-Explorer-TachyonCore-FindFileBySizeAndHash Instruction

High 7.2

In plain English

A high-severity improper input validation in DEX from TeamViewer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)1.1%top 34.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

Affected products (as reported)

Vendor	Product	Versions
TeamViewer	DEX	0 – before 21.1

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/