Command Injection in 1E-Nomad-GetCmContentLocations Instruction

published 2025-12-11 10 mo ago modified 2026-10-08 32 d ago also EUVD-2025-202676

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits: 0; none known

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19.2. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

Patch / fix

fixed in 1

TeamViewer DEX 19.2

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 10 mo ago (2025-12-11)

Exploit prediction

1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

TeamViewer DEX

Classification

Weakness

CWE-20 Improper Input Validation
CWE-77 Improper Neutralization of Special Elements used in a Command

References

teamviewer.com /en/resources/trust-center/security-bulletins/tv-2025-1006/
vendor-advisory

Sources

CVE List CVE-2025-64988
NVD CVE-2025-64988

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary