CVE-2025-64989
High
Description
A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Teamviewer Digital Employee Experience
PublishedDec 11, 2025
First seenDec 11, 2025
Weakness typeCWE-20Improper input validation
How to fix
Update
- teamviewer digital_employee_experience21.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| teamviewer digital_employee_experience | v < 21.1 | 21.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.