CVE-2019-18988

TeamViewer Desktop through 14.7.1965 encrypts protected settings — including the OptionsPasswordAES value and, in versions before 9.x, the Unattended Access password — with a single AES key shared across all customers' installations since at least v7.0.43148, so anyone who learns that key can decrypt secrets stored in the Windows registry or TeamViewer configuration files. An attacker who already has a session or local access on a system (or who can reach registry/configuration data stored off-machine, such as on a file share or online) can recover the stored credentials and, on pre-9.x versions, the Unattended Access password, gaining remote login and headless file browsing to the system. All TeamViewer Desktop deployments running affected versions through 14.7.1965 are exposed, with the direct remote-login bypass risk greatest on versions before 9.x. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), a public proof-of-concept decryptor is available, and EPSS estimates a 4.7% probability of exploitation within 30 days (91st percentile).

What to do: Apply TeamViewer updates per vendor instructions (CISA KEV required action), upgrading installations beyond 14.7.1965 and prioritizing pre-9.x deployments where the Unattended Access password is directly recoverable. Rotate Unattended Access passwords after updating, since credentials encrypted with the shared key may have been decrypted, and avoid storing TeamViewer registry/configuration keys on file shares or online storage. Audit systems with unattended access enabled and review TeamViewer connection logs for anomalous remote logins.