Improper Input and Privilege Handling for Authenticated Users in TeamViewer DEX (former 1E DEX)
1. Summary
Command Injection and Privilege Escalation vulnerabilities were identified in TeamViewer DEX (former 1E DEX).
The vulnerabilities have been fixed with new versions listed below.
At this time, there is no indication that these vulnerabilities have been exploited in the wild.
2. Vulnerability Details
2.1 Privilege escalation in TeamViewer DEX - DeleteFileByPath instruction
CVE-ID | |
Description | Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1 on Windows allows a low‑privileged local attacker to delete protected system files via a crafted RPC control junction or symlink that is followed when the delete instruction executes.
The vulnerability has been fixed with 1E client version 26.1. We recommend updating to the latest available version of the 1E client. |
CVSS3.1 Score | 5.7 (Medium) |
CVSS3.1 Vector String | |
Problem type | |
Affected Products | 1E Client |
Fixed versions | 1E Client 26.1 (or higher) |
2.2 Command Injection in 1E-Nomad-RunPkgStatusRequest Instruction in TeamViewer DEX
CVE-ID | |
Description | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper input validation allows authenticated attackers with actioner privilege to run elevated arbitrary commands on connected hosts via malicious commands injected into the instruction’s input field.
Users of the 1E Client version 24.5 or higher are not affected. We recommend updating to the latest 1E Client version (26.1 or above).
The affected instruction will no longer be shipped with DEX Platform versions 26.1 and above. We recommend deleting the instruction from tenants created before v26.1. and On-premise installations. |
CVSS3.1 Score | 6.8 (Medium) |
CVSS3.1 Vector String | |
Problem type | |
Affected Products | TeamViewer (1E) DEX - 1E-Nomad-RunPkgStatusRequest instruction |
Fixed versions | 1E Client 24.5 (or higher) |
3. Solutions and mitigations
| Vulnerability | Solution/Mitigation |
|---|---|
CVE-2026-23563: Privilege escalation on TeamViewer DEX via DeleteFileByPath instruction | Update to 1E Client version 26.1 or above |
CVE-2026-23571: Command Injection in 1E-Nomad-RunPkgStatusRequest Instruction |
|
4. Acknowledgments
We would like to thank the Lockheed Martin Red Team for the discovery and responsible disclosure.