CVE-2025-64989 - CVE House
Back to Database
Status published High CVE-2025-64989

Command Injection in 1E-Explorer-TachyonCore-FindFileBySizeAndHash Instruction

Vulnerability Description

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64989

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Lockheed Martin Red Team

References

More from TeamViewer

View All →
CVE-2025-64995
Privilege Escalation via Process Hijacking in 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction
Medium 6.5
CVE-2025-64994
Privilege Escalation via Uncontrolled Search Path in 1E-Nomad-SetWorkRate instruction
Medium 6.5
CVE-2025-64993
Command Injection in 1E-ConfigMgrConsoleExtensions Instructions
Medium 6.8
CVE-2025-64992
Command Injection in 1E-Nomad-PauseNomadJobQueue Instruction
Medium 6.8
CVE-2025-64991
Command Injection in 1E-PatchInsights-Deploy Instruction
Medium 6.8

Affected Vendor

Affected Software

DEX
Vulnerable Versions:
0

Timeline

Official Publish: December 11th, 2025
Last Modified: December 11th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact