CVE‑2019‑18988: TeamViewer Desktop Bypass Remote‑Login Vulnerability Allows Credential Decryption
What It Is – TeamViewer Desktop re‑uses the same AES encryption key across different customers’ installations. An attacker who discovers this key can decrypt registry or configuration data, including the unattended‑access password that grants remote login.
Exploitability – The vulnerability is publicly disclosed; no public exploit code is known, but the attack requires possession of the shared key, which could be obtained through reverse‑engineering or insider leakage. CVSS (v3.1) is rated 7.5 (High).
Affected Products – TeamViewer Desktop (all versions prior to the vendor‑issued fix).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for unique cryptographic keys per tenant – a core access‑control assurance objective.
- Highlights gaps in key‑management policies that auditors will probe for evidence of segregation and rotation.
- Underscores the importance of continuous monitoring of credential‑use events to provide a defensible audit trail when remote‑access tools are used.
Recommended Actions
- Apply TeamViewer’s latest patch that introduces per‑customer key generation.
- Conduct an immediate inventory of all TeamViewer deployments and verify that each instance uses a unique encryption key.
- Update key‑management procedures to enforce generation, rotation, and secure storage of keys per tenant.
- Enable logging of unattended‑access password usage and review logs for anomalous activity.
- Document the remediation steps as evidence for audit readiness.
Source: CISA KEV – CVE‑2019‑18988