CVE-2026-23571

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23571", "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "state": "PUBLISHED", "assignerShortName": "TV", "dateReserved": "2026-01-14T13:54:40.322Z", "datePublished": "2026-01-29T08:41:45.941Z", "dateUpdated": "2026-01-29T16:53:17.959Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["1E-Nomad-RunPkgStatusRequest Instruction"], "product": "DEX", "vendor": "TeamViewer", "versions": [{"lessThanOrEqual": "20", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Lockheed Martin Red Team"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper input validation allows authenticated attackers with actioner privilege to run elevated arbitrary commands on connected hosts via malicious commands injected into the instruction\u2019s input field. Users of 1E Client version 24.5 or higher are not affected."}], "value": "A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper input validation allows authenticated attackers with actioner privilege to run elevated arbitrary commands on connected hosts via malicious commands injected into the instruction\u2019s input field.\u00a0Users of 1E Client version 24.5 or higher are not affected."}], "impacts": [{"capecId": "CAPEC-248", "descriptions": [{"lang": "en", "value": "CAPEC-248 Command Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "shortName": "TV", "dateUpdated": "2026-01-29T08:41:45.941Z"}, "references": [{"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1002/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the TeamViewer DEX Client (1E Client) to the latest available version. Remove the instruction 1E-Nomad-RunPkgStatusRequest from DEX Portal."}], "value": "Update the TeamViewer DEX Client (1E Client) to the latest available version.\u00a0Remove the instruction 1E-Nomad-RunPkgStatusRequest from DEX Portal."}], "source": {"discovery": "UNKNOWN"}, "title": "Command Injection in 1E-Nomad-RunPkgStatusRequest Instruction in TeamViewer DEX", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T15:57:13.887818Z", "id": "CVE-2026-23571", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T16:53:17.959Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23571", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-29T15:57:13.887818Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T15:57:21.342Z"}}], "cna": {"title": "Command Injection in 1E-Nomad-RunPkgStatusRequest Instruction in TeamViewer DEX", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Lockheed Martin Red Team"}], "impacts": [{"capecId": "CAPEC-248", "descriptions": [{"lang": "en", "value": "CAPEC-248 Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TeamViewer", "modules": ["1E-Nomad-RunPkgStatusRequest Instruction"], "product": "DEX", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "20"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the TeamViewer DEX Client (1E Client) to the latest available version.\u00a0Remove the instruction 1E-Nomad-RunPkgStatusRequest from DEX Portal.", "supportingMedia": [{"type": "text/html", "value": "Update the TeamViewer DEX Client (1E Client) to the latest available version. Remove the instruction 1E-Nomad-RunPkgStatusRequest from DEX Portal.", "base64": false}]}], "references": [{"url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1002/"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper input validation allows authenticated attackers with actioner privilege to run elevated arbitrary commands on connected hosts via malicious commands injected into the instruction\u2019s input field.\u00a0Users of 1E Client version 24.5 or higher are not affected.", "supportingMedia": [{"type": "text/html", "value": "A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper input validation allows authenticated attackers with actioner privilege to run elevated arbitrary commands on connected hosts via malicious commands injected into the instruction\u2019s input field. Users of 1E Client version 24.5 or higher are not affected.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "shortName": "TV", "dateUpdated": "2026-01-29T08:41:45.941Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23571", "state": "PUBLISHED", "dateUpdated": "2026-01-29T16:53:17.959Z", "dateReserved": "2026-01-14T13:54:40.322Z", "assignerOrgId": "13430f76-86eb-43b2-a71c-82c956ef31b6", "datePublished": "2026-01-29T08:41:45.941Z", "assignerShortName": "TV"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["1E-Nomad-RunPkgStatusRequest Instruction"], "product": "DEX", "vendor": "TeamViewer", "versions": [{"lessThanOrEqual": "20", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@teamviewer.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:teamviewer:digital_employee_experience:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E2A5CE4-D147-45E1-8D16-3257B6E79E70", "versionEndExcluding": "26.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-RunPkgStatusRequest instruction. Improper input validation allows authenticated attackers with actioner privilege to run elevated arbitrary commands on connected hosts via malicious commands injected into the instruction\u2019s input field.\u00a0Users of 1E Client version 24.5 or higher are not affected."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos fue descubierta en TeamViewer DEX (anteriormente 1E DEX), espec\u00edficamente dentro de la instrucci\u00f3n 1E-Nomad-RunPkgStatusRequest. Una validaci\u00f3n de entrada inadecuada permite a atacantes autenticados con privilegio de actioner ejecutar comandos arbitrarios elevados en hosts conectados a trav\u00e9s de comandos maliciosos inyectados en el campo de entrada de la instrucci\u00f3n. Los usuarios de 1E Cliente versi\u00f3n 24.5 o superior no se ven afectados."}], "id": "CVE-2026-23571", "lastModified": "2026-06-17T10:21:47.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "psirt@teamviewer.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23571", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T15:57:13.887818Z", "version": "2.0.3"}}]}, "published": "2026-01-29T09:16:04.867", "references": [{"source": "psirt@teamviewer.com", "tags": ["Vendor Advisory"], "url": "https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1002/"}], "sourceIdentifier": "psirt@teamviewer.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "psirt@teamviewer.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:31:27.508097+00:00", "value": {"mitigation_remediation": ["Update the TeamViewer DEX Client (1E Client) to the latest available version", "Remove the 1E-Nomad-RunPkgStatusRequest instruction from the DEX Portal", "Re\u2011evaluate and limit actioner privileges to only users that truly need them"], "summary": {"action": "Patch", "impact": "Arbitrary command execution via command injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the TeamViewer Digital Employee Experience (DEX) client, also known as the 1E Client. Users running the 1E Client version below 24.5 are vulnerable; users of version 24.5 or later are not affected. The issue is present in environments where TeamViewer DEX is deployed and the suspect instruction is enabled.", "description_and_impact": "A command injection flaw exists in the 1E-Nomad-RunPkgStatusRequest instruction of TeamViewer DEX. The lack of proper input validation allows an authenticated user who has actioner privileges to inject and execute arbitrary elevated commands on hosts that are connected to the DEX Portal. This is a type of input validation weakness (CWE\u201120) and can compromise confidentiality, integrity, and availability of the affected systems.", "risk_and_exploitability": "The CVSS score of 6.8 indicates a medium to high severity. The EPSS probability is below 1\u202f%, suggesting a low likelihood of widespread exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid credentials with actioner role access and the presence of the 1E-Nomad-RunPkgStatusRequest instruction, meaning the attack surface is restricted to privileged users within authenticated DEX sessions."}}}}, "created": "2026-01-30T08:43:24.419565+00:00", "updated": "2026-04-18T01:45:33.387639+00:00", "vendors": ["teamviewer", "teamviewer$PRODUCT$dex"]}