A command injection flaw exists in the 1E-Nomad-RunPkgStatusRequest instruction of TeamViewer DEX. The lack of proper input validation allows an authenticated user who has actioner privileges to inject and execute arbitrary elevated commands on hosts that are connected to the DEX Portal. This is a type of input validation weakness (CWE‑20) and can compromise confidentiality, integrity, and availability of the affected systems.

The vulnerability affects the TeamViewer Digital Employee Experience (DEX) client, also known as the 1E Client. Users running the 1E Client version below 24.5 are vulnerable; users of version 24.5 or later are not affected. The issue is present in environments where TeamViewer DEX is deployed and the suspect instruction is enabled.

The CVSS score of 6.8 indicates a medium to high severity. The EPSS probability is below 1 %, suggesting a low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid credentials with actioner role access and the presence of the 1E-Nomad-RunPkgStatusRequest instruction, meaning the attack surface is restricted to privileged users within authenticated DEX sessions.