The vulnerability is a command injection flaw in TeamViewer DEX Platform On‑Premises caused by missing server‑side validation of instruction input. Authenticated users with at least questioner privileges can inject commands into specific instructions, and if successfully exploited, the attacker can execute elevated commands on devices connected to the platform.

TeamViewer DEX Platform On‑Premises versions prior to 9.2 are affected; version 9.2 and later contain the fix.

The CVSS score of 6.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires authentication and the presence of a questioner‑level user, making it an internal threat vector. An attacker with the required privileges could inject commands that execute with elevated privileges on connected devices.