CVE-2025-64993 Command Injection in 1E-ConfigMgrConsoleExtensions Instructions

Medium 6.8 Published 11 Dec 2025 Updated 11 Dec 2025

Authenticated attackers with Actioner privileges can inject arbitrary commands to execute elevated code on connected devices via TeamViewer DEX.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-64993?

CVE-2025-64993 is a medium-severity command injection vulnerability in TeamViewer DEX, published on 11 Dec 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

Weakness: CWE-77, CWE-20

Which versions are affected by CVE-2025-64993?

It affects 1 product.

Products include Teamviewer Digital Employee Experience.

How do I fix CVE-2025-64993?

No fix has been published for CVE-2025-64993 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-64993 being exploited?

There is no known exploitation of CVE-2025-64993 in the wild and no public exploit code.

Sources

Also known as GHSA-fh67-v6r3-9f98.