This vulnerability involves improper input validation (CWE-20) in TeamViewer DEX On-Premises (formerly 1E DEX On-Premises) before version 9.2. Authenticated users with questioner-level privileges can inject commands into specific instructions, potentially leading to elevated command execution on connected devices. The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability at a low to medium level. The vendor has not yet provided an official fix or remediation level, and no patch links are available.

Exploitation could allow an authenticated user with limited privileges to execute elevated commands on devices connected to the TeamViewer DEX On-Premises platform. This may lead to unauthorized actions affecting confidentiality, integrity, and availability of those devices. However, the impact is limited by the requirement for authentication with at least questioner privileges. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the platform to trusted users only and monitor for unusual activity from authenticated users with questioner privileges. Avoid granting unnecessary privileges to users. Follow updates from TeamViewer for any forthcoming patches or mitigations.