Command Injection in 1E-Explorer-TachyonCore-DevicesListeningOnAPort Instruction

published 2025-12-11 10 mo ago modified 2026-10-08 32 d ago also EUVD-2025-202678

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits: 0; none known

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction prior V21. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

Patch / fix

fixed in 1

TeamViewer DEX 21

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 10 mo ago (2025-12-11)

Exploit prediction

1.19% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

TeamViewer DEX

Classification

Weakness

CWE-20 Improper Input Validation
CWE-77 Improper Neutralization of Special Elements used in a Command

References

teamviewer.com /en/resources/trust-center/security-bulletins/tv-2025-1006/
vendor-advisory

Sources

CVE List CVE-2025-64986
NVD CVE-2025-64986

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary