Incomplete protection of personal password settings

CVE-ID

CVE-2024-0819

Description

In the Teamviewer Client prior Version 15.51.5, access to the personal password setting doesn’t require administrative rights. A low privileged user on a multi-user system, with access to the client, can set a personal password. That potentially allows an unprivileged user to establish a remote connection to other currently logged-in users on the same system.

TeamViewer clients with activated setting “changes require administrative right on this computer” or additional security features active and properly configured are not affected, e.g.

• Options
• Password
• Conditional Access
• BYOC
• Block & Allow List
• Access control
• TFA for connections
• One-time-password

TeamViewer recommends using Easy Access for unattended access, combined with the Two-Factor-Authentication, this protection covers accessing the TeamViewer account and any machine you support via TeamViewer.

If you still consider to use a personal password please make sure to follow the guidelines and use a strong password.

CVSS3.0 Score

Base Score 7.3 (High)

CVSS3.1 Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Problem type

CWE-269: Improper Privilege Management

Teamviewer Remote Full Client

< 15.51.5

Update available

Teamviewer Remote Host

< 15.51.5

Update available