CVE-2025-64995

A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction prior V3.4. Improper protection of the execution path on the local device allows attackers, with local access to the device during execution, to hijack the process and execute arbitrary code with SYSTEM privileges.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.6 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:teamviewer:digital_employee_experience:*:*:*:*:*:*:*:*

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de escalada de privilegios fue descubierta en TeamViewer DEX (anteriormente 1E DEX), específicamente dentro de la instrucción 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting anterior a la V3.4. La protección inadecuada de la ruta de ejecución en el dispositivo local permite a los atacantes, con acceso local al dispositivo durante la ejecución, secuestrar el proceso y ejecutar código arbitrario con privilegios de SYSTEM.

Information

Published : 2025-12-11 12:16

Updated : 2026-10-08 10:10

NVD link : CVE-2025-64995

Mitre link : CVE-2025-64995

CVE.ORG link : CVE-2025-64995

JSON object : View

Products Affected

teamviewer

digital_employee_experience

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2025-64995", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64995", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-11T14:37:06.691098Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@teamviewer.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "affected": [{"source": "psirt@teamviewer.com", "affectedData": [{"vendor": "TeamViewer", "modules": ["1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction"], "product": "DEX", "versions": [{"status": "affected", "version": "0", "lessThan": "3.4", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-11T12:16:26.593", "references": [{"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/", "tags": ["Vendor Advisory"], "source": "psirt@teamviewer.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@teamviewer.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction prior V3.4. Improper protection of the execution path on the local device allows attackers, with local access to the device during execution, to hijack the process and execute arbitrary code with SYSTEM privileges."}, {"lang": "es", "value": "Una vulnerabilidad de escalada de privilegios fue descubierta en TeamViewer DEX (anteriormente 1E DEX), espec\u00edficamente dentro de la instrucci\u00f3n 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting anterior a la V3.4. La protecci\u00f3n inadecuada de la ruta de ejecuci\u00f3n en el dispositivo local permite a los atacantes, con acceso local al dispositivo durante la ejecuci\u00f3n, secuestrar el proceso y ejecutar c\u00f3digo arbitrario con privilegios de SYSTEM."}], "lastModified": "2026-10-08T10:10:00.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:teamviewer:digital_employee_experience:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDD38A7B-AC11-48BC-8CC8-60A5A50D36FC", "versionEndExcluding": "3.4"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@teamviewer.com"}