TeamViewer DEX Command Injection Vulnerability Allowing Remote Execution of Elevated Commands

A command injection vulnerability has been identified in TeamViewer DEX (formerly 1E DEX) versions prior to 21. This vulnerability exists within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction, where improper input validation allows authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation of this vulnerability enables remote execution of elevated commands on devices connected to the platform.

Impact

Exploitation of this vulnerability allows for command injection, enabling authenticated attackers to execute arbitrary commands with elevated privileges on affected devices.

Remediation

Users of TeamViewer DEX SaaS should note that most instructions have been automatically updated with version 25.12. On-premise customers should contact their Customer Success Manager for updates.