Executive Risk Summary
"The 1E Client's Nomad module is vulnerable to an improper link resolution issue, allowing an attacker with local unprivileged access to delete arbitrary files on a Windows system. This vulnerability can be exploited by creating symbolic links, enabling an attacker to manipulate file access and potentially cause significant damage to the system."
Operational Audit Arsenal
Target Type module
Target Asset Nomad
Standard Path Windows system
PowerShell
# 🛠️ Senior Engineer Universal Audit
# Target: Nomad (module)
$Target = "Nomad"
$SearchPaths = @("$env:windir\System32", "$env:ProgramFiles", "${env:ProgramFiles(x86)}")
Get-ChildItem -Path $SearchPaths -Filter $Target -Recurse -ErrorAction SilentlyContinue |
Select-Object FullName, @{Name="Version";Expression={$_.VersionInfo.ProductVersion}}Patch Impact Forecast
Reboot Required
likely required
Service Disruption
low to moderate
Internal Work Notes
Recommend upgrading to version 25.3 or later to mitigate the vulnerability, and monitor system logs for suspicious activity related to file access and symbolic link creation.
Intelligence Sources
Official Advisory https://capec.mitre.org/data/definitions/27.html
Official Advisory https://cwe.mitre.org/data/definitions/59.html
NVD Database Detail https://nvd.nist.gov/vuln/detail/CVE-2025-1683
Official Advisory https://www.teamviewer.com/en/resources/trust-center/security-bulletins/1e-2025-2001/
Scope of Impact
Platform
Original NVD Description
"Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an attacker with local unprivileged access on a Windows system to delete arbitrary files on the device by exploiting symbolic links."
Data compiled from NVD, MSRC, and CISA KEV Catalog. Intelligence synthesized via AI. Scripts provided for diagnostic purposes under MIT License.