TeamViewer Desktop Bypass Remote Login Vulnerability (CVE-2019-18988)

What is affected, what to do

TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• TeamViewer lte *..14.7.1965

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Identify every host running TeamViewer Desktop using your software inventory, EDR, or the registry paths HKLM\SOFTWARE\TeamViewer and HKLM\SOFTWARE\WOW6432Node\TeamViewer. All versions up to and including 14.7.1965 are affected. Legacy installs older than v9.x are the most critical.
   • Upgrade: Move to a release later than 14.7.1965. A patch is available from the vendor; look up the exact fixed version in the TeamViewer security bulletin. Uninstall unused or legacy (v7/v8) installations outright rather than upgrading them.
   • Rotate secrets: Change every unattended-access password, options password (OptionsPasswordAES), and stored proxy or licence credential on affected hosts. The AES key is public, so treat every previously stored value as disclosed.
   • Hunt off-host configs: Search file shares, GPO/SCCM/Intune packages, deployment repos, ticket attachments, and backups for exported .reg or .tvopt files containing TeamViewer settings. Any such file lets an attacker decrypt the stored password without touching the endpoint. Remove these files and rotate the affected passwords immediately.
   • Block shadow installs: Use application control (AppLocker/WDAC) to block unsanctioned TeamViewer binaries until the estate is cleaned up.
2. 02

   Runbook step 2

   Mitigation layers

   • Access configuration: Disable the static "personal password". Switch to Easy Access bound to TeamViewer accounts with enforced 2FA. Restrict the block-and-allow list to your company profile, and lock these settings with a TeamViewer Management Console policy.
   • Network segmentation: Allow outbound TeamViewer traffic (TCP 5938, with fallback over 443/80 to TeamViewer infrastructure) only from approved support systems or zones. In OT/KRITIS segments, replace TeamViewer with a controlled remote-maintenance path such as a jump host with session recording.
   • Endpoint hardening: Audit read access to the TeamViewer registry keys with a SACL. Review filesystem ACLs on %ProgramFiles%\TeamViewer. Minimise local admin rights, since anyone with a local session can read and decrypt the stored values.
   • IAM/least privilege: Do not share one unattended-access password across hosts. Use a unique password per host and keep it in a PAM solution or password vault.
   • Deployment hygiene: Stop distributing TeamViewer through .reg exports that carry embedded password blobs. Use the official MSI rollout with account assignment through the Management Console instead.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon EID 1 / Security 4688: Look for reg query or reg export command lines containing TeamViewer, or PowerShell Get-ItemProperty calls on *AES values. KQL: DeviceProcessEvents | where ProcessCommandLine has "TeamViewer" and ProcessCommandLine has_any ("reg query","reg export","PasswordAES").
   • Security 4663 (requires SACL): Alert on reads of \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\TeamViewer by any process other than TeamViewer_Service.exe or TeamViewer.exe. Sigma shape: ObjectName|contains: 'TeamViewer' with a ProcessName|endswith exclusion list.
   • Post-exploitation tooling: Use EDR signatures or memory artefacts to catch known credential harvesters, such as the Metasploit module post/windows/gather/credentials/teamviewer_passwords or PowerShell scripts that embed the public AES key or IV as string literals.
   • TeamViewer logs: Forward Connections_incoming.txt and TeamViewer*_Logfile.log from %ProgramFiles%\TeamViewer to the SIEM. Alert on inbound sessions outside maintenance windows, sessions from unknown TeamViewer IDs, or file transfers without a matching change ticket.
   • Network telemetry (Zeek/Suricata): Flag TCP 5938 connections or connections to TeamViewer master servers from hosts outside the approved inventory. These indicate a freshly dropped or hidden TeamViewer instance used for persistence.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions before v9.x , this allowed for attackers to decrypt the Unattended Access password to the system (which allows for remote login to the system as well as headless file browsing). The latest version still uses the same key for OptionPasswordAES but appears to have changed how the Unattended Access password is stored. While in most cases an attacker requires an existing session on a system, if the registry/configuration keys were stored off of the machine (such as in a file share or online), an attacker could then decrypt the required password to login to the system.

Source: cvelistv5, NVD (NIST), CISA KEV Catalog

Vendors and products

• TeamViewer TeamViewer

References & sources

• community.teamviewer.comt5/Knowledge-Base/tkb-p/Knowledgebase?threadtype=label&labels=S…x_refsource_MISC, Broken link, Vendor advisory
• whynotsecurity.comblog/teamviewerx_refsource_MISC, Exploit, Third-party advisory
• twitter.comBlurbdust/status/1224212682594770946?s=20x_refsource_MISC, Third-party advisory
• community.teamviewer.comt5/Announcements/Specification-on-CVE-2019-18988/td-p/82264x_refsource_MISC, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18988government-resource, US government resource