CVE-2025-36537
BaseFortify
Publication date: 2025-06-24
Last updated on: 2025-06-26
Assigner: TeamViewer Germany GmbH
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-732 | The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an incorrect permission assignment in the TeamViewer Client (Full and Host) for Windows versions prior to 15.67, specifically affecting the Remote Management features: Backup, Monitoring, and Patch Management. It allows a local unprivileged user to delete arbitrary files with SYSTEM privileges by exploiting the MSI rollback mechanism, leading to potential privilege escalation. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow a local unprivileged attacker to delete arbitrary files with SYSTEM-level privileges on the affected Windows system. This can lead to privilege escalation, potentially compromising system integrity and security. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by verifying the installed version of TeamViewer Remote Management on Windows systems. Specifically, check if the version is prior to 15.67, as those versions are affected. Since the vulnerability requires local access and involves incorrect permission assignments related to Remote Management features, network detection is limited. On the system, you can check the TeamViewer version using commands like 'wmic product where "name like 'TeamViewer%'" get Name, Version' in Command Prompt or 'Get-ItemProperty "HKLM:\Software\TeamViewer" | Select-Object -Property DisplayVersion' in PowerShell. Additionally, verify if Remote Management features (Backup, Monitoring, Patch Management) are installed and enabled. There are no specific commands provided to detect the permission issue or MSI rollback exploitation directly. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update TeamViewer Remote Full Client and Host for Windows to version 15.67 or later, where the vulnerability has been resolved. Users should ensure that all affected systems are upgraded to the latest available version to prevent exploitation. Since the vulnerability requires local access and involves Remote Management features, disabling or restricting these features temporarily may also reduce risk until the update is applied. [1]