Vulnerability · Published Dec 11, 2025 · Assigned by TV
CVE-2025-64993Command Injection in 1E-ConfigMgrConsoleExtensions Instructions
Medium 6.8
In plain English
A medium-severity improper input validation in DEX from TeamViewer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.9%top 40.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TeamViewer | DEX | 0 – before 29 |
| TeamViewer | DEX | 0 – before 29 |
| TeamViewer | DEX | 0 – before 30 |
| TeamViewer | DEX | 0 – before 29 |
| TeamViewer | DEX | 0 – before 29 |
| TeamViewer | DEX | 0 – before 29 |
| TeamViewer | DEX | 0 – before 29 |
| TeamViewer | DEX | 0 – before 29 |
| TeamViewer | DEX | 0 – before 29 |
| TeamViewer | DEX | 0 – before 29 |
| TeamViewer | DEX | 0 – before 29 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H