TeamViewer DEX Command Injection

TeamViewer DEX is a remote management and support tool used by organizations to manage their devices. It's part of the TeamViewer suite, which allows administrators to remotely access and control devices. The vulnerability discovered in this CVE affects the 1E-PatchInsights-Deploy instruction prior version V15, allowing authenticated attackers with Actioner privileges to inject arbitrary commands.

You're affected if you use A command. Specific version info not stated in the advisory. If you don't recognise this software, you're probably not affected.

Concrete steps:

1. Upgrade to TeamViewer DEX version V15 or later: https://www.teamviewer.com/en/downloads/
2. Immediate mitigations:
   • Restrict network access to your TVDEX instance (firewall it from the public internet)
   • Audit admin account activity for suspicious access patterns
   • Monitor for unauthorized token creation

• www.teamviewer.com