TeamViewer DEX Command Injection Vulnerability Allowing Remote Execution of Elevated Commands

A command injection vulnerability has been identified in TeamViewer DEX (formerly 1E DEX) versions prior to 19.2. This vulnerability resides within the 1E-Nomad-GetCmContentLocations instruction and results from improper input validation. Authenticated attackers with Actioner privileges can exploit this flaw to inject arbitrary commands, which are then executed remotely with elevated rights on devices connected to the platform.

Impact

Exploitation of this vulnerability allows for remote execution of injected commands with elevated privileges on the affected device.

Remediation

Users of TeamViewer DEX should update to version 19.2 or later. For on-premise installations, contact the responsible Customer Success Manager for assistance.