Security News > 2020 > August > TeamViewer flaw could be exploited to crack users’ password

A high-risk vulnerability in TeamViewer for Windows could be exploited by remote attackers to crack users' password and lead to further system exploitation.

TeamViewer is an application developed by German company TeamViewer GmbH and is available for Windows, macOS, Linux, Chrome OS, iOS, Android, Windows RT Windows Phone 8 and BlackBerry operating systems.

CVE-2020-13699 is a security weakness arising from an unquoted search path or element - more specifically, it's due to the application not properly quoting its custom URI handlers - and could be exploited when the system with a vulnerable version of TeamViewer installed visits a maliciously crafted website.

"An attacker could embed a malicious iframe in a website with a crafted URL that would launch the TeamViewer Windows desktop client and force it to open a remote SMB share," explained Jeffrey Hofmann, a security engineer with Praetorian, who discovered and responsibly disclosed the flaw.

According to the company, the vulnerability affects TeamViewer versions 8 through 15 for the Windows platform.

News URL

http://feedproxy.google.com/~r/HelpNetSecurity/~3/c4pu1mChmr4/