Medium severity · published Oct 24, 2019
CVE-2019-18196
A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed in 12.0.214399), 13.2.36215 (fixed in…
6.7
CVSS
0.6%
EPSS
No
On KEV
Description
A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed in 12.0.214399), 13.2.36215 (fixed in 13.2.36216), and 14.6.4835 (fixed in 14.7.1965) on Windows could allow an attacker to perform code execution on a target system via a service restart where the DLL was previously installed with administrative privileges. Exploitation requires that an attacker be able to create a new file in the TeamViewer application directory; directory permissions restrict that by default.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
Teamviewer · Teamviewer
before 11.0.214397; 12.0.0 before 12.0.214399; 13.0.0 before 13.2.36216; 14.0.0 before 14.7.1965 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18196
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18196
Vendor Advisory
https://community.teamviewer.com/t5/Announcements/Security-bulletin-CVE-2019-18196/td-p/74564
safebreach.com
https://safebreach.com/Post/TeamViewer-Windows-Client-v11-to-v14-DLL-Preloading-and-Potential-Abuses-CVE-2019-18196
More from Teamviewer
7.0
CVE-2019-18988
TeamViewer Desktop Bypass Remote Login Vulnerability
9.8
CVE-2018-16550
TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by skipping the "Cancel" step, which makes it easier to…
8.8
CVE-2021-34859
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0
8.8
CVE-2020-13699
TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers
8.8
CVE-2019-18251
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS