Technical Severity
HIGH
CVSS v3.1 Metrics
7
/ 10
Minimal Risk
Critical
Vector Specification
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitation Likelihood
EPSS Prediction
8.80
%
Predictive Probability
Percentile Rank
92.3
th
Documented as more likely to be exploited than 92.3% of known CVEs.
Detection Date
Nov 03, 2021
Remediation Due
May 03, 2022
CISA Catalog Active
Threat Analysis
TeamViewer Desktop allows for bypass of remote-login access control because the same AES key is used for different customers' installations. If an attacker were to know this key, they could decrypt protected information stored in registry or configuration files or decryption of the Unattended Access password to the system (which allows for remote login to the system).
Remediation Directive
Apply updates per vendor instructions.