CVE-2026-2695

Full vulnerability record from the local CVENow database.

Description

A command injection vulnerability was discovered in TeamViewer DEX Platform On-Premises (former 1E DEX Platform On-Premises) prior to version 9.2. Improper input validation allows authenticated users with at least questioner privileges to inject commands in specific instructions. Exploitation could lead to execution of elevated commands on devices connected to the platform.

Severity

MEDIUM

CVSS score

6.3 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-05-13 17:16:19.453000

Last modified

2026-10-26 17:10:03.270000

View original CVE JSON

{
  "id": "CVE-2026-2695",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-13T17:16:19.453",
  "lastModified": "2026-10-26T17:10:03.270",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A command\ninjection vulnerability was discovered in TeamViewer DEX Platform On-Premises\n(former 1E DEX Platform On-Premises) prior to version 9.2. Improper input validation allows\nauthenticated users with at least questioner privileges to inject commands in specific\ninstructions. Exploitation could lead to execution of elevated commands on\ndevices connected to the platform."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de comandos fue descubierta en TeamViewer DEX Platform On-Premises (anteriormente 1E DEX Platform On-Premises) anterior a la versión 9.2. Una validación de entrada inadecuada permite a usuarios autenticados con al menos privilegios de questioner inyectar comandos en instrucciones específicas. La explotación podría conducir a la ejecución de comandos elevados en dispositivos conectados a la plataforma."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "TeamViewer",
          "product": "DEX (On-Premises)",
          "defaultStatus": "unaffected",
          "modules": [
            "Platform"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "9.2",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T17:19:55.259243Z",
          "id": "CVE-2026-2695",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.teamviewer.com/de/resources/trust-center/security-bulletins/tv-2026-1004/",
      "source": "[email protected]"
    }
  ]
}