Remote Session Access Control Bypass Leading to Remote Code Execution
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 15.82, 15.64.8 (Legacy Windows 7 & 8), 14.7.48855 (Windows), 13.2.36230 (Windows), 14.7.48855 (Linux), and 3 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- TeamViewer Full Client
From 15.0 · fixed in 15.82; From 15.64.0 (Legacy Windows 7 & 8) · fixed in 15.64.8 (Legacy Windows 7 & 8); From 14.7.0 (Windows) · fixed in 14.7.48855 (Windows); From 13.2.0 (Windows) · fixed in 13.2.36230 (Windows); From 14.7.0 (Linux) · fixed in 14.7.48855 (Linux); From 13.2.0 (Linux) · fixed in 13.2.153995 (Linux); From 14.7.0 (MacOS) · fixed in 14.7.48855 (MacOS); From 13.2.0 (MacOS) · fixed in 13.2.153994 (MacOS)
- TeamViewer Host
From 15.0 · fixed in 15.82; From 15.64.0 (Legacy Windows 7 & 8) · fixed in 15.64.8 (Legacy Windows 7 & 8); From 14.7.0 (Windows) · fixed in 14.7.48855 (Windows); From 13.2.0 (Windows) · fixed in 13.2.36230 (Windows); From 14.7.0 (Linux) · fixed in 14.7.48855 (Linux); From 13.2.0 (Linux) · fixed in 13.2.153995 (Linux); From 14.7.0 (MacOS) · fixed in 14.7.48855 (MacOS); From 13.2.0 (MacOS) · fixed in 13.2.153994 (MacOS)