CVE-2019-18988

TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' installations. It used a shared AES key for all installations since at least as far back as v7.0.43148, and used it for at least OptionsPasswordAES in the current version of the product. If an attacker were to know this key, they could decrypt protect information stored in the registry or configuration files of TeamViewer. With versions before v9.x , this allowed for attackers to decrypt the Unattended Access password to the system (which allows for remote login to the system as well as headless file browsing). The latest version still uses the same key for OptionPasswordAES but appears to have changed how the Unattended Access password is stored. While in most cases an attacker requires an existing session on a system, if the registry/configuration keys were stored off of the machine (such as in a file share or online), an attacker could then decrypt the required password to login to the system.

• CWE-521
• CWE-521

• https://community.teamviewer.com/t5/Announcements/Specification-on-CVE-2019-18988/td-p/82264Vendor Advisory
• https://community.teamviewer.com/t5/Knowledge-Base/tkb-p/Knowledgebase?threadtype=label&labels=SecurityBroken Link, Vendor Advisory
• https://twitter.com/Blurbdust/status/1224212682594770946?s=20Third Party Advisory
• https://whynotsecurity.com/blog/teamviewer/Exploit, Third Party Advisory
• https://community.teamviewer.com/t5/Announcements/Specification-on-CVE-2019-18988/td-p/82264Vendor Advisory
• https://community.teamviewer.com/t5/Knowledge-Base/tkb-p/Knowledgebase?threadtype=label&labels=SecurityBroken Link, Vendor Advisory
• https://twitter.com/Blurbdust/status/1224212682594770946?s=20Third Party Advisory
• https://whynotsecurity.com/blog/teamviewer/Exploit, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18988US Government Resource

Published

Feb 7, 2020

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18980On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bu…7.5
• CVE-2019-18981Pimcore before 6.2.2 lacks an Access Denied outcome for a ce…9.8
• CVE-2019-18982bundles/AdminBundle/Controller/Admin/EmailController.php in …6.1
• CVE-2019-18985Pimcore before 6.2.2 lacks brute force protection for the 2F…9.8
• CVE-2019-18986Pimcore before 6.2.2 allow attackers to brute-force (guess) …7.5
• CVE-2019-18987An issue was discovered in the AbuseFilter extension through…5.3
• CVE-2019-18989A partial authentication bypass vulnerability exists on Medi…5.4
• CVE-2019-1899A vulnerability in the web interface of Cisco RV110W, RV130W…5.3
• CVE-2019-18990A partial authentication bypass vulnerability exists on Real…5.4
• CVE-2019-18991A partial authentication bypass vulnerability exists on Athe…5.4
• CVE-2019-18992OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-…5.4
• CVE-2019-18993OpenWrt 18.06.4 allows XSS via the "New port forward" Name f…5.4