CVE-2025-64988 Command Injection in 1E-Nomad-GetCmContentLocations Instruction

High 7.2 Published 11 Dec 2025 Updated 11 Dec 2025

Authenticated attackers with Actioner privileges can inject arbitrary commands to execute elevated code on connected devices via the GetCmContentLocations instruction.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-64988?

CVE-2025-64988 is a high-severity command injection vulnerability in TeamViewer DEX, published on 11 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19.2. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

Weakness: CWE-77, CWE-20

Which versions are affected by CVE-2025-64988?

It affects 1 product.

Products include Teamviewer Digital Employee Experience.

How do I fix CVE-2025-64988?

No fix has been published for CVE-2025-64988 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-64988 being exploited?

There is no known exploitation of CVE-2025-64988 in the wild and no public exploit code.

Sources

Also known as GHSA-pqmf-56qm-jqf9.