TeamViewer DEX Improper Link Resolution Vulnerability Allowing Deletion of Protected System Files

A vulnerability exists in TeamViewer DEX (formerly 1E DEX) - 1E Client, prior to version 26.1, on Windows. It involves improper link resolution before file access, specifically with the 1E-Explorer-TachyonCore-DeleteFileByPath instruction. This vulnerability allows a low-privileged local attacker to delete protected system files by exploiting a crafted RPC control junction or symlink, which is followed during the execution of the delete instruction.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of protected system files, potentially causing system instability or loss of critical data.

Remediation

Users are advised to update to TeamViewer DEX 1E Client version 26.1 or higher.