CVE-2019-18988

What Is TeamViewer?

TeamViewer is one of the most widely deployed remote access and remote support tools in the world, used by IT help desks, managed service providers, and individual users to remotely control desktops. Its "Unattended Access" feature lets a device be controlled without a person present to approve the connection, which requires storing a password locally in encrypted form — making the strength of that local encryption directly security-critical.

Overview

CVE-2019-18988 is a local vulnerability in TeamViewer Desktop stemming from the use of a hard-coded, shared AES encryption key across all installations of the product, rather than a per-installation or per-customer key. Sensitive values — including the Unattended Access password and other configuration secrets stored in the Windows registry or local configuration files — are encrypted with this key. Because the key is identical across every deployment, anyone who obtains it (which is straightforward given it ships inside the widely distributed client) can decrypt these values from any compromised machine's local files, without needing to interact with TeamViewer's servers.

Technical Details

The underlying weakness (CWE-521, Weak Password Requirements, as classified by NVD, though the practical issue is closer to CWE-321 "Use of Hard-coded Cryptographic Key") means the confidentiality of locally stored secrets depends entirely on the AES key remaining unknown to attackers — an assumption that fails once the key is extracted from the client binary or from public research. An attacker who already has local, low-privileged access to a machine (or access to an offline copy of its registry/config files, e.g. from a stolen laptop, backup, or forensic image) can decrypt the Unattended Access password and use it to establish a fully authenticated remote session to that system, effectively achieving remote login. This is why the attack vector is classified as Local with high privileges/impact rather than a purely remote, unauthenticated exploit — it typically serves as a follow-on step after some other initial local access is obtained.

Discovery

This issue was addressed through TeamViewer's routine vulnerability handling and patch process; no independent named researcher disclosure is confidently attributed here.

Exploitation Context

CISA's addition of CVE-2019-18988 to the KEV catalog confirms it has been observed used in real-world attacks. Because TeamViewer's Unattended Access feature is a common persistence and lateral-movement mechanism sought by intruders and ransomware affiliates, decrypting stored credentials from a compromised endpoint is valuable for maintaining or escalating access — particularly in environments where the same TeamViewer configuration/registry values are replicated across many machines via imaging or endpoint management tooling.

Remediation

1. Update TeamViewer to a version that addresses CVE-2019-18988 — confirm the installed build against TeamViewer's current release notes.
2. Rotate Unattended Access passwords on any endpoint where the version history is uncertain, especially systems provisioned from a shared image.
3. Restrict Unattended Access to only the machines that genuinely require it, and prefer per-session, human-approved connections elsewhere.
4. Protect local configuration and registry hives from unauthorized read access, including offline access via backups or disk images.
5. Monitor TeamViewer connection logs for unattended sessions initiated from unexpected source IPs or at unusual hours.