EUVD-2025-19030Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.
AnalysisAI
CVE-2025-36537 is a local privilege escalation vulnerability in TeamViewer Client (Full and Host) and Tensor prior to version 15.67 on Windows that allows an unprivileged local user to delete arbitrary files with SYSTEM privileges by exploiting improper permission assignment in the MSI rollback mechanism. The vulnerability is limited to Remote Management features (Backup, Monitoring, and Patch Management), has a CVSS score of 7.0, and requires local access with medium attack complexity but no user interaction. This vulnerability represents a significant elevation-of-privilege risk for organizations relying on TeamViewer for remote management.
Technical ContextAI
The vulnerability stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), where the TeamViewer MSI (Microsoft Installer) package does not properly restrict file system permissions during rollback operations. The MSI rollback mechanism, designed to restore system state after failed installations or uninstalls, operates with SYSTEM-level privileges. An unprivileged local user can manipulate or trigger this rollback process to delete critical files with elevated privileges. This affects the Remote Management feature set (Backup, Monitoring, and Patch Management modules) in TeamViewer Remote and TeamViewer Tensor products. The root cause is insufficient validation of file paths and improper ACLs (Access Control Lists) on resources accessed during MSI rollback, allowing privilege escalation from local user context to SYSTEM context.
RemediationAI
Immediate remediation: (1) Update TeamViewer Remote/Host and TeamViewer Tensor to version 15.67 or later on all Windows systems; (2) Prioritize updates for systems where Remote Management features (Backup, Monitoring, Patch Management) are actively deployed or used by privileged users. Interim mitigations if immediate patching is not feasible: (1) Restrict local system access to trusted users only—implement strong access controls on systems running TeamViewer; (2) Disable Remote Management features if not in active use (Backup, Monitoring, Patch Management); (3) Implement file system monitoring and integrity checking (e.g., Windows File Integrity Monitoring) on critical system directories to detect unauthorized deletions; (4) Use Windows AppLocker or similar application control to restrict execution of MSI-related processes by unprivileged users. For detailed patch availability and download links, visit TeamViewer's official download portal and security advisory page specific to CVE-2025-36537.
Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today