CVE-2019-18988

TeamViewer Desktop Bypass Remote Login

7.0 HIGHActively exploited (CISA KEV)Public exploitEPSS 4.71%

Published7 Feb 2020
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions before v9.x , this allowed for attackers to decrypt the Unattended Access password to the system (which allows for remote login to the system as well as headless file browsing). The latest version still uses the same key for OptionPasswordAES but appears to have changed how the Unattended Access password is stored. While in most cases an attacker requires an existing session on a system, if the registry/configuration keys were stored off of the machine (such as in a file share or online), an attacker could then decrypt the required password to login to the system.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityHigh

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Teamviewer≤ 14.7.1965

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

https://community.teamviewer.com/t5/Announcements/Specification-on-CVE-2019-18988/td-p/82264Vendor Advisory
https://community.teamviewer.com/t5/Knowledge-Base/tkb-p/Knowledgebase?threadtype=label&labels=SecurityBroken LinkVendor Advisory
https://twitter.com/Blurbdust/status/1224212682594770946?s=20Third Party Advisory
https://whynotsecurity.com/blog/teamviewer/ExploitThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18988US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2019-18988 being actively exploited?

Yes. CVE-2019-18988 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2019-18988?

CVE-2019-18988 has a CVSS 3.1 base score of 7.0, rated high. EPSS estimates a 4.71% probability of exploitation.

Which products are affected by CVE-2019-18988?

Affected products include Teamviewer.

How do I fix CVE-2019-18988?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-18988 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.