Description (CNA)
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TeamViewer / Full Client | affected 15.0 before 15.82; affected 15.64.0 (Legacy Windows 7 & 8) before 15.64.8 (Legacy Windows 7 & 8); affected 14.7.0 (Windows) before 14.7.48855 (Windows); affected 13.2.0 (Windows) before 13.2.36230 (Windows); affected 14.7.0 (Linux) before 14.7.48855 (Linux); affected 13.2.0 (Linux) before 13.2.153995 (Linux); affected 14.7.0 (MacOS) before 14.7.48855 (MacOS); affected 13.2.0 (MacOS) before 13.2.153994 (MacOS) |
| TeamViewer / Host | affected 15.0 before 15.82; affected 15.64.0 (Legacy Windows 7 & 8) before 15.64.8 (Legacy Windows 7 & 8); affected 14.7.0 (Windows) before 14.7.48855 (Windows); affected 13.2.0 (Windows) before 13.2.36230 (Windows); affected 14.7.0 (Linux) before 14.7.48855 (Linux); affected 13.2.0 (Linux) before 13.2.153995 (Linux); affected 14.7.0 (MacOS) before 14.7.48855 (MacOS); affected 13.2.0 (MacOS) before 13.2.153994 (MacOS) |
CWE
CWE-22
References
ADP enrichment
No English description supplied.
No references supplied.