CVE-2025-12687: TeamViewer DEX DOS Vulnerability

CVE-2025-12687 Overview

CVE-2025-12687 is an input validation vulnerability in the TeamViewer Digital Employee Experience (DEX) Client, formerly known as the 1E Client. The flaw resides in the Content Distribution Service component NomadBranch.exe on Windows. An attacker on an adjacent network can send a crafted command that terminates the service, resulting in a denial of service condition. The vulnerability affects DEX Client versions prior to 25.11 for Windows. TeamViewer disclosed the issue in security bulletin TV-2025-1005.

Critical Impact
An unauthenticated adjacent-network attacker can crash the NomadBranch.exe service, disrupting content distribution across managed endpoints.

Affected Products

TeamViewer Digital Employee Experience (DEX) Client (formerly 1E Client) prior to version 25.11
TeamViewer DEX Content Distribution Service (NomadBranch.exe)
Microsoft Windows platforms running the affected client

Discovery Timeline

2025-12-11 - CVE-2025-12687 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12687

Vulnerability Analysis

The vulnerability affects the Content Distribution Service in the TeamViewer DEX Client, historically deployed under the 1E branding as NomadBranch. The service listens for commands over the network and processes them without sufficient validation. A malicious actor on the same broadcast domain or logical adjacent network can send a crafted command that the service fails to parse safely, causing NomadBranch.exe to crash. Termination of the service disrupts peer-to-peer content distribution, which enterprises rely on to deliver software updates, patches, and configuration payloads to managed endpoints. The condition is classified under [CWE-20] Improper Input Validation.

Root Cause

The root cause is missing or insufficient validation of attacker-controlled input processed by the Content Distribution Service listener. When NomadBranch.exe receives a malformed or unexpected command structure, an unhandled error path leads to process termination rather than graceful rejection.

Attack Vector

Exploitation requires network adjacency, meaning the attacker must reside on the same layer 2 segment or an adjacent routed segment reachable by the service. No authentication or user interaction is required. The impact is limited to availability; confidentiality and integrity are not affected. TeamViewer has not published exploitation details, and no public proof-of-concept exists at the time of writing. See the TeamViewer Security Bulletin TV-2025-1005 for vendor guidance.

Detection Methods for CVE-2025-12687

Indicators of Compromise

Unexpected termination or repeated crashes of the NomadBranch.exe process on Windows endpoints running the DEX Client.
Windows Application event log entries showing faulting module records tied to NomadBranch.exe.
Interruptions in scheduled content distribution, patch deployment, or software staging jobs managed by the DEX Client.

Detection Strategies

Monitor for Windows Service Control Manager events indicating the Content Distribution Service stopped unexpectedly or entered a failed state.
Correlate inbound network traffic to the NomadBranch listener port with subsequent process crashes on the same host.
Baseline the normal uptime of NomadBranch.exe across the fleet and alert on anomalous restart frequency.

Monitoring Recommendations

Enable Windows Error Reporting (WER) collection to capture crash dumps from NomadBranch.exe for forensic analysis.
Ingest endpoint process telemetry into a centralized SIEM or data lake to detect cluster-wide crash patterns indicating active exploitation.
Alert on repeated service restarts within short time windows across multiple endpoints in the same subnet.

How to Mitigate CVE-2025-12687

Immediate Actions Required

Upgrade the TeamViewer DEX Client to version 25.11 or later on all affected Windows systems.
Inventory all endpoints running the former 1E Client and confirm the installed version through configuration management tooling.
Prioritize patching for endpoints on shared or less-trusted network segments where adjacent attackers are more likely to reach the service.

Patch Information

TeamViewer resolved CVE-2025-12687 in DEX Client version 25.11 for Windows. Detailed remediation guidance is available in the TeamViewer Security Bulletin TV-2025-1005.

Workarounds

Restrict inbound traffic to the NomadBranch listener using host-based firewall rules, allowing only trusted management subnets.
Segment endpoints running the DEX Client away from untrusted or guest networks to reduce adjacent-network exposure.
Configure the Windows service recovery options to automatically restart NomadBranch.exe on failure, reducing operational impact while patching is in progress.

bash

# Example: restrict inbound access to NomadBranch service using Windows Firewall
# Replace <TrustedSubnet> with your management network range
netsh advfirewall firewall add rule name="Restrict NomadBranch" ^
  dir=in action=block program="%ProgramFiles%\1E\Client\NomadBranch.exe" ^
  enable=yes profile=any

netsh advfirewall firewall add rule name="Allow NomadBranch from Mgmt" ^
  dir=in action=allow program="%ProgramFiles%\1E\Client\NomadBranch.exe" ^
  remoteip=<TrustedSubnet> enable=yes profile=any