Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 15.82, 15.64.8 (Legacy Windows 7 & 8), 14.7.48855 (Windows), 13.2.36230 (Windows), 14.7.48855 (Linux), and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- TeamViewer Full Client
From 15.0 · fixed in 15.82; From 15.64.0 (Legacy Windows 7 & 8) · fixed in 15.64.8 (Legacy Windows 7 & 8); From 14.7.0 (Windows) · fixed in 14.7.48855 (Windows); From 13.2.0 (Windows) · fixed in 13.2.36230 (Windows); From 14.7.0 (Linux) · fixed in 14.7.48855 (Linux); From 13.2.0 (Linux) · fixed in 13.2.153995 (Linux); From 14.7.0 (MacOS) · fixed in 14.7.48855 (MacOS); From 13.2.0 (MacOS) · fixed in 13.2.153994 (MacOS)
- TeamViewer Host
From 15.0 · fixed in 15.82; From 15.64.0 (Legacy Windows 7 & 8) · fixed in 15.64.8 (Legacy Windows 7 & 8); From 14.7.0 (Windows) · fixed in 14.7.48855 (Windows); From 13.2.0 (Windows) · fixed in 13.2.36230 (Windows); From 14.7.0 (Linux) · fixed in 14.7.48855 (Linux); From 13.2.0 (Linux) · fixed in 13.2.153995 (Linux); From 14.7.0 (MacOS) · fixed in 14.7.48855 (MacOS); From 13.2.0 (MacOS) · fixed in 13.2.153994 (MacOS)