CVE-2025-64989 Command Injection in 1E-Explorer-TachyonCore-FindFileBySizeAndHash Instruction

High 7.2 Published 11 Dec 2025 Updated 11 Dec 2025

Authenticated attackers with Actioner privileges can inject arbitrary commands to execute elevated code on connected devices via the FindFileBySizeAndHash instruction.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-64989?

CVE-2025-64989 is a high-severity command injection vulnerability in TeamViewer DEX, published on 11 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

Weakness: CWE-20

Which versions are affected by CVE-2025-64989?

It affects 1 product.

Products include Teamviewer Digital Employee Experience.

How do I fix CVE-2025-64989?

No fix has been published for CVE-2025-64989 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-64989 being exploited?

There is no known exploitation of CVE-2025-64989 in the wild and no public exploit code.

Sources

Also known as GHSA-r6v6-gcvm-4vxr.