{"id":"CVE-2026-23564","state":"PUBLISHED","title":"Transmission of Unencrypted Data in Content Distribution Service","description":"A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to cause normally encrypted UDP traffic to be sent in cleartext. This can result in disclosure of sensitive information.","publishedAt":"2026-01-29T08:43:43.799Z","updatedAt":"2026-01-29T16:53:10.746Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"TV"},"assigner":"TV","products":["TeamViewer DEX"],"affected":[{"vendor":"TeamViewer","product":"DEX","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"26.1","versionType":"custom"}],"modules":["Content Distribution Service","NomadBranch.exe"],"platforms":["Windows"]}],"references":["https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1001/"],"weaknesses":["CWE-319"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/23xxx/CVE-2026-23564.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23564","state":"PUBLISHED","datePublished":"2026-01-29T08:43:43.799Z","dateUpdated":"2026-01-29T16:53:10.746Z","assignerShortName":"TV","assignerOrgId":"13430f76-86eb-43b2-a71c-82c956ef31b6","dateReserved":"2026-01-14T13:54:40.322Z"},"containers":{"cna":{"title":"Transmission of Unencrypted Data in Content Distribution Service","descriptions":[{"lang":"en","value":"A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 26.1 for Windows allows an attacker on the adjacent network to cause normally encrypted UDP traffic to be sent in cleartext. This can result in disclosure of sensitive information."}],"affected":[{"vendor":"TeamViewer","product":"DEX","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"26.1","versionType":"custom"}],"modules":["Content Distribution Service","NomadBranch.exe"],"platforms":["Windows"]}],"references":[{"url":"https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1001/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-319","description":"CWE-319 Cleartext Transmission of Sensitive Information","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"TV","orgId":"13430f76-86eb-43b2-a71c-82c956ef31b6","dateUpdated":"2026-01-29T08:43:43.799Z"},"credits":[{"lang":"en","type":"finder","value":"Threat Hunt Team of Bank of America"}],"impacts":[{"capecId":"CAPEC-220","descriptions":[{"lang":"en","value":"CAPEC-220 Client-Server Protocol Manipulation"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update the TeamViewer DEX Client (1E Client) to the latest available version."}],"value":"Update the TeamViewer DEX Client (1E Client) to the latest available version."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-29T15:57:06.915459Z","id":"CVE-2026-23564","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-29T16:53:10.746Z"}}]}}}