PT-2018-13626 · Teamviewer · Teamviewer

Published 2018-09-05 · Updated 2019-10-03 · CVE-2018-16550

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TeamViewer versions 10.x through 13.x

Description The issue allows remote attackers to bypass the brute-force authentication protection mechanism. This is achieved by skipping the "Cancel" step, making it easier to determine the correct value of the default 4-digit PIN.

Recommendations For versions 10.x through 13.x, consider temporarily restricting access to the authentication mechanism until a patch is available. As a mitigation measure, users can also change the default 4-digit PIN to a stronger password to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-16550

Affected Products

Teamviewer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-16550 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16550 · Vendor Advisory
• https://twitter.com/vah_13/status/1036894081350291457 · Note