CVSS: 8.8EPSS: 20%CPEs: 2EXPL: 1CVE-2020-13699 – TeamViewer Unquoted URI Handler SMB Redirect
https://notcve.org/view.php?id=CVE-2020-13699
TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated by a teamviewer10: --play URL. An attacker could force a victim to send an NTLM authentication request and either relay the request or capture the hash for offline password cracking. This affects teamviewer10, teamviewer8, teamviewerapi, tvchat1, tvcontrol1, tvfiletransfer1, tvjoinv8, tvpresent1, tvsendfile1, tvsqcustomer1, tvsqsupport1, tvvideocall1, and tvvpn1. The issue is fixed in 8.0.258861, 9.0.258860, 10.0.258873, 11.0.258870, 12.0.258869, 13.2.36220, 14.2.56676, 14.7.48350, and 15.8.3. • https://github.com/Dilshan-Eranda/CVE-2020-13699 https://community.teamviewer.com/t5/Announcements/Statement-on-CVE-2020-13699/td-p/98448 https://jeffs.sh/CVEs/CVE-2020-13699.txt • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.0EPSS: 0%CPEs: 1EXPL: 3CVE-2019-18988 – TeamViewer Desktop Bypass Remote Login Vulnerability
https://notcve.org/view.php?id=CVE-2019-18988
TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions before v9.x , this allowed for attackers to decrypt the Unattended Access password to the system (which allows for remote login to the system as well as headless file browsing). The latest version still uses the same key for OptionPasswordAES but appears to have changed how the Unattended Access password is stored. • https://github.com/mr-r3b00t/CVE-2019-18988 https://github.com/reversebrain/CVE-2019-18988 https://community.teamviewer.com/t5/Announcements/Specification-on-CVE-2019-18988/td-p/82264 https://community.teamviewer.com/t5/Knowledge-Base/tkb-p/Knowledgebase?threadtype=label&labels=Security https://twitter.com/Blurbdust/status/1224212682594770946?s=20 https://whynotsecurity.com/blog/teamviewer - • CWE-521: Weak Password Requirements •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2019-19362
https://notcve.org/view.php?id=CVE-2019-19362
An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendor states that it was later fixed.) Upon login, every communication is saved within Windows main memory. When a user logs out or deletes conversation history (but does not exit the application), this data is not wiped from main memory, and therefore could be read by a local user with the same or greater privileges. Se detectó un problema en la funcionalidad Chat de la aplicación de escritorio TeamViewer versión 14.3.4730 en Windows. • http://nestedif.com/teamviewer-vulnerability-improper-session-handling-leading-to-information-disclosure-advisory • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-18251 – OMRON CX-Supervisor Vulnerable Third-Party Component Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-18251
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. This version of Teamviewer is vulnerable to an obsolete function vulnerability requiring user interaction to exploit. En Omron CX-Supervisor, versiones 3.5 (12) y anteriores, Omron CX-Supervisor entregada con Teamviewer versión 5.0.8703 QS. Esta versión de Teamviewer es susceptible a una vulnerabilidad de función obsoleta que requiere la interacción del usuario para explotar. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OMRON CX-Supervisor. • https://www.us-cert.gov/ics/advisories/icsa-19-318-04 https://www.zerodayinitiative.com/advisories/ZDI-19-997 • CWE-477: Use of Obsolete Function •
CVSS: 6.9EPSS: 0%CPEs: 5EXPL: 0CVE-2019-18196
https://notcve.org/view.php?id=CVE-2019-18196
A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed in 12.0.214399), 13.2.36215 (fixed in 13.2.36216), and 14.6.4835 (fixed in 14.7.1965) on Windows could allow an attacker to perform code execution on a target system via a service restart where the DLL was previously installed with administrative privileges. Exploitation requires that an attacker be able to create a new file in the TeamViewer application directory; directory permissions restrict that by default. Una vulnerabilidad de carga lateral de DLL en el Windows Service en TeamViewer versiones hasta 11.0.133222 (corregido en 11.0.214397), 12.0.181268 (corregido en 12.0.214399), 13.2.36215 (corregido en 13.2.36216) y 14.6.4835 (corregido en 14.7.1965) sobre Windows, podría permitir a un atacante llevar a cabo la ejecución de código en un sistema de destino mediante un reinicio del servicio donde la DLL fue instalada previamente con privilegios administrativos. La explotación requiere que un atacante sea capaz de crear un nuevo archivo en el directorio de la aplicación TeamViewer; los permisos de directorio restringen eso por defecto. • https://community.teamviewer.com/t5/Announcements/Security-bulletin-CVE-2019-18196/td-p/74564 https://safebreach.com/Post/TeamViewer-Windows-Client-v11-to-v14-DLL-Preloading-and-Potential-Abuses-CVE-2019-18196 • CWE-426: Untrusted Search Path •