CVE-2025-64987: teamviewer digital employee experience

csirt@kutim:~/threat-intel/cve/CVE-2025-64987

CVSS 7.2 · High EPSS 1,2%

Kerentanan Improper Input Validation pada teamviewer digital employee experience. Skor CVSS 3.1 7.2 (High) menurut teamviewer.com.

Deskripsi (NVD)

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

Rincian

Terbit di NVD: 11 Desember 2025
Terakhir diubah: 8 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 7.2 (High), sumber teamviewer.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 66,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
teamviewer	digital employee experience	Semua versi sebelum 21.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2025-1006/ advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 00:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.