CVE-2019-18988
Published: November 3, 2021
Official Description
TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system).
CISA KEV Advisory
TeamViewer Desktop Bypass Remote Login Vulnerability
TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system).
Apply updates per vendor instructions.
Risk Analysis
TeamViewer Desktop has a vulnerability where the same AES key is used across different customer installations, potentially allowing attackers to bypass remote-login access control. This could lead to decryption of sensitive information or unattended access passwords. Its active exploitation in the wild and inclusion in CISA's KEV catalog make it a critical security concern.
This vulnerability is actively being exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog. An attacker knowing the shared AES key could decrypt sensitive data and gain remote login access.
Ensure TeamViewer Desktop is updated to a version that addresses this shared AES key vulnerability. Implement strong, unique passwords for unattended access and consider multi-factor authentication where possible.
Technical Analysis
CVE-2019-18988 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2019-18988 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2019-18988 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1