Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-64992

Command Injection in 1E-Nomad-PauseNomadJobQueue Instruction

Medium6.8EPSS 0.87%
Published
Updated
Reserved
Assigned by
TV

Description

A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote execution of elevated commands on devices connected to the platform.

Scores

CVSS scores of CVE-2025-64992, by who scored it
Scored byCVSSScoreVector
TVCNA (assigner)3.1Medium6.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
NVDNVD · Analyzed3.1High7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.87% · top 41% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.

Weakness

Affected products

What to do

Solution: On-prem users should update to the latest available version (v25 or later). SaaS instances have been updated automatically.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-64992 badge
[![CVE-2025-64992](https://trackcve.app/badge/CVE-2025-64992.svg)](https://trackcve.app/cve/CVE-2025-64992)

Record last updated .