CVE-2025-64986: TeamViewer DEX RCE Vulnerability

CVE-2025-64986 Overview

CVE-2025-64986 is a command injection vulnerability in TeamViewer Digital Employee Experience (DEX), formerly known as 1E DEX. The flaw resides in the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction prior to V21. Improper input validation [CWE-20, CWE-77] allows authenticated attackers holding Actioner privileges to inject arbitrary commands. Successful exploitation results in remote execution of elevated commands on devices connected to the platform.

Critical Impact
Authenticated Actioner-level attackers can execute arbitrary elevated commands across managed endpoints, compromising confidentiality, integrity, and availability of the entire DEX-managed device fleet.

Affected Products

TeamViewer Digital Employee Experience (DEX), formerly 1E DEX
1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction versions prior to V21
Endpoints managed by vulnerable DEX deployments

Discovery Timeline

2025-12-11 - CVE-2025-64986 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64986

Vulnerability Analysis

The vulnerability exists in the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction, a built-in Tachyon Core query used to enumerate devices listening on a specific network port. The instruction accepts parameters from authenticated Actioner users but fails to sanitize input before incorporating it into command execution logic. This permits operating system command injection [CWE-77].

Because Tachyon instructions execute with elevated privileges on agent-managed endpoints, injected commands run in a privileged context. The vulnerability affects every endpoint connected to the DEX platform, turning a single authenticated session into a fleet-wide execution primitive.

Root Cause

The root cause is improper input validation [CWE-20] in the parameter handling of the DevicesListeningOnAPort instruction. Attacker-supplied values, such as port numbers or filter strings, flow into a command construction path without escaping or allow-list validation, enabling appended or chained shell metacharacters.

Attack Vector

An attacker authenticates to the TeamViewer DEX console with Actioner privileges. The attacker then triggers the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction, supplying a crafted parameter containing shell metacharacters or command separators. The platform dispatches the malformed instruction to connected agents, where the injected commands execute with elevated rights.

The attack is network-reachable, requires no user interaction, and produces full impact on confidentiality, integrity, and availability of targeted devices. No public proof-of-concept or exploit has been observed, and the issue is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detailed technical context is provided in the TeamViewer Security Bulletin TV-2025-1006.

Detection Methods for CVE-2025-64986

Indicators of Compromise

Execution of the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction with parameter values containing shell metacharacters such as ;, &&, |, backticks, or $().
Tachyon agent process spawning unexpected child processes such as cmd.exe, powershell.exe, /bin/sh, or bash shortly after instruction dispatch.
Outbound network connections or file writes originating from the Tachyon agent service immediately after an Actioner-initiated query.

Detection Strategies

Audit DEX/Tachyon instruction execution logs for non-numeric or oversized values supplied to the port parameter of DevicesListeningOnAPort.
Correlate Actioner account activity with endpoint process creation events to identify privileged process chains originating from the agent service.
Hunt for anomalous use of Actioner-tier accounts, especially execution of port-enumeration instructions outside scheduled operational windows.

Monitoring Recommendations

Enable verbose logging on the DEX Tachyon Core and forward instruction parameter values to a centralized SIEM for inspection.
Alert on any privilege change, service installation, or scheduled task creation on endpoints within minutes of an Actioner instruction dispatch.
Track failed and successful Actioner authentications, particularly from new source IPs or after-hours sessions.

How to Mitigate CVE-2025-64986

Immediate Actions Required

Upgrade the 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction to V21 or later as directed by TeamViewer.
Review and reduce the number of accounts holding Actioner privileges to the minimum required for operations.
Rotate credentials for any Actioner accounts suspected of compromise and enforce multi-factor authentication on the DEX console.
Audit recent executions of DevicesListeningOnAPort for malformed parameters and investigate affected endpoints.

Patch Information

TeamViewer addressed the issue in V21 of the affected instruction. Administrators should consult the TeamViewer Security Bulletin TV-2025-1006 for the official remediation procedure and verify the deployed instruction version across all Tachyon Core servers.

Workarounds

Temporarily disable or remove the vulnerable 1E-Explorer-TachyonCore-DevicesListeningOnAPort instruction until V21 is deployed.
Restrict Actioner role assignments and require approval workflows for instruction execution where supported.
Network-segment the DEX management console so that only trusted administrative workstations can reach it.

bash

# Verify the deployed instruction version on the Tachyon Core server
# Replace <core-host> with your Tachyon Core hostname
curl -s -u <admin> "https://<core-host>/Consumer/Instructions" \
  | grep -i "DevicesListeningOnAPort"

# Expected: version reported as V21 or higher after patching