Authentication Bypass in TeamViewer Versions 10.x to 13.x
CVE-2018-16550

9.8CRITICAL

Key Information:

Vendor

Teamviewer

Status
Teamviewer
Vendor
CVE Published:
5 September 2018

What is CVE-2018-16550?

The vulnerability identified in TeamViewer versions 10.x through 13.x allows remote attackers to exploit the authentication process. By circumventing the 'Cancel' step in the brute-force mechanism, attackers can more easily identify valid 4-digit PINs. This could potentially lead to unauthorized access to user sessions, compromising user security and privacy.

References

https://twitter.com/vah_13/status/1036894081350291457
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.