1. Summary
TeamViewer has resolved multiple local privilege escalation vulnerabilities affecting TeamViewer Remote Management components, including Monitoring, Patch Management, and Advanced Asset Management. Under specific conditions, a local authenticated attacker with low privileges could exploit weaknesses in IPC mechanisms, component installation and activation processes, DLL loading, or temporary file handling to execute arbitrary code or commands with SYSTEM/root privileges.
At the time of publication, TeamViewer is not aware of any active exploitation in the wild.
Customers using TeamViewer Remote Management Add-Ons are advised to update to the latest versions and ensure their Remote Management services and Clients are up to date.
2. Vulnerability details
I. Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring
|
CVE-ID |
|
|
Description |
An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remote Management Monitoring component prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute scripts as SYSTEM/root. |
|
CVSS3.1 Score |
Base Score 7.8 (High) |
|
CVSS3.1 Vector String |
|
|
Problem type |
|
|
Affected versions |
TeamViewer Full Client and Host
|
II. Local Privilege Escalation via IPC Broker Impersonation in TeamViewer Remote Management Monitoring for Windows
|
CVE-ID |
|
|
Description |
Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to impersonate the IPC broker and cause the Monitoring service to execute arbitrary code with NT AUTHORITY\SYSTEM privileges, resulting in local privilege escalation. |
|
CVSS3.1 Score |
Base Score 7.8 (High) |
|
CVSS3.1 Vector String |
|
|
Problem type |
|
|
Affected versions |
Remote Management - Monitoring Add-on
|
III. Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows
|
CVE-ID |
|
|
Description |
Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allows a local authenticated attacker with low privileges to supply a signed executable through a forged IPC response and cause it to load a malicious DLL from a user-writable temporary directory. Successful exploitation results in arbitrary code execution with NT AUTHORITY\SYSTEM privileges. |
|
CVSS3.1 Score |
Base Score 7.8 (High) |
|
CVSS3.1 Vector String |
|
|
Problem type |
|
|
Affected versions |
TeamViewer Full Client and Host
|
IV. Local Privilege Escalation via DLL Hijacking in TeamViewer Monitoring for Windows
|
CVE-ID |
|
|
Description |
A DLL loading vulnerability in the TeamViewer Remote Management Monitoring installer for Windows prior to version 26.10.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges. Exploitation requires user interaction. |
|
CVSS3.1 Score |
Base Score 7.3 (High) |
|
CVSS3.1 Vector String |
|
|
Problem type |
|
|
Affected versions |
TeamViewer Remote Management – Monitoring Add-on
|
V. Local Privilege Escalation during Advanced Asset Management Installation in TeamViewer Client for Windows
|
CVE-ID |
|
|
Description |
Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can place a crafted installer options file that is processed by the Advanced Asset Management installer during service activation. |
|
CVSS3.1 Score |
Base Score 7.3 (High) |
|
CVSS3.1 Vector String |
|
|
Problem type |
|
|
Affected versions |
TeamViewer Full Client and Host
|
VI. Local Privilege Escalation via Race Condition in TeamViewer Patch Management for Windows
|
CVE-ID |
|
|
Description |
A race condition in the installation process of TeamViewer Remote Management - Patch Management for Windows prior to version 26.9.1 allows a local authenticated attacker with low privileges to execute arbitrary code with elevated privileges by replacing the service executable in an insufficiently protected temporary directory during Patch Management activation. |
|
CVSS3.1 Score |
Base Score 7.3 (High) |
|
CVSS3.1 Vector String |
|
|
Problem type |
|
|
Affected versions |
TeamViewer Remote Management – Patch Management Add-on
|
3. Affected software and versions
|
Component
|
Versions
|
Info
|
|---|---|---|
|
TeamViewer Full Client & Host (Windows) |
15.83 |
|
|
TeamViewer Full Client & Host (Linux) |
15.83 |
|
|
TeamViewer Full Client & Host(MacOS) |
15.83 |
|
Legacy
|
Versions
|
Info
|
|---|---|---|
|
Teamviewer Full Client & Host v15.64 (Windows) |
15.64.10 |
|
|
TeamViewer Full Client & Host v14.7 (Windows) |
14.7.48868 |
|
|
TeamViewer Full Client & Host v14.7 (Linux) |
14.7.48868 |
|
|
TeamViewer Full Client & Host v14.7 (macOS) |
14.7.259386 |
|
|
TeamViewer Full Client v13.2 (Windows) |
13.2.36231 |
|
|
TeamViewer Full Client v13.2 (Linux) |
13.2.154008 |
|
|
TeamViewer Full Client & Host v13.2 (macOS) |
13.2.154007 |
|
Legacy
|
Versions
|
Info
|
|---|---|---|
|
ITbrain_Monitoring_Service.exe (Windows) |
26.10.1 |
Auto-update |
|
MonitoringDaemon (MacOS) |
26.10.1 |
Auto-update |
|
teamviewer-monitoringd (Linux) |
26.10.1 |
Auto-update |
|
MonitoringInstaller.exe (Windows) |
26.10.1 |
Auto-update |
|
RM_PatchManagement_Service.exe (Windows) |
26.9.1 |
Auto-update |
|
RM_PatchManagement_Service.exe for Client v14.7 (Windows) |
24.12.5 |
Auto-update |
4. Solutions and mitigations
Update to the latest TeamViewer Client version (15.83 or the latest version available). The affected Remote Management components are delivered via auto-update.
5. Acknowledgements
We thank the security researchers involved for the discovery and the responsible disclosure. Researchers are explicitly named in the individual CVE records.