CVE-2026-23571
📋 TL;DR
A command injection vulnerability in TeamViewer DEX (formerly 1E DEX) allows authenticated attackers with actioner privilege to execute arbitrary commands with elevated privileges on connected hosts. The vulnerability exists in the 1E-Nomad-RunPkgStatusRequest instruction due to improper input validation. Users of 1E Client version 24.5 or higher are not affected.
💻 Affected Systems
- TeamViewer DEX (formerly 1E DEX)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of connected hosts, allowing attackers to install malware, steal data, pivot to other systems, or disrupt operations.
Likely Case
Privilege escalation leading to unauthorized system access, data exfiltration, or deployment of ransomware on vulnerable endpoints.
If Mitigated
Limited impact if proper network segmentation, least privilege access, and monitoring are in place to detect anomalous command execution.
🎯 Exploit Status
Exploitation requires authenticated access with actioner privileges, making it an insider threat or post-compromise attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1E Client version 24.5 or higher
Vendor Advisory: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1002/
Restart Required: Yes
Instructions:
1. Download and install 1E Client version 24.5 or higher from the official TeamViewer portal. 2. Restart the affected systems to apply the update. 3. Verify the update was successful by checking the version.
🔧 Temporary Workarounds
Restrict Actioner Privileges
allLimit the number of users with actioner privileges to only those who absolutely need them for their role.
Network Segmentation
allSegment networks to limit the blast radius if exploitation occurs, preventing lateral movement.
🧯 If You Can't Patch
- Implement strict access controls and monitor for unusual command execution patterns in logs.
- Deploy endpoint detection and response (EDR) solutions to detect and block malicious command injection attempts.
🔍 How to Verify
Check if Vulnerable:
Check the installed version of 1E Client on endpoints. If below 24.5, the system is vulnerable.Check Version:
On Windows: '1E-Client.exe --version' or check in Programs and Features. On Linux: '1e-client --version' or check package manager.Verify Fix Applied:
Confirm that 1E Client version is 24.5 or higher after applying the update.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution via 1E-Nomad-RunPkgStatusRequest instruction
- Multiple failed authentication attempts followed by successful actioner login
Network Indicators:
- Anomalous outbound connections from endpoints after command execution
- Unexpected network traffic to command and control servers
SIEM Query:
source="1e-client.log" AND (event="RunPkgStatusRequest" AND command="*;*" OR command="*|*" OR command="*&*")