EUVD-2025-19030CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows allows a local unprivileged user to trigger arbitrary file deletion with SYSTEM privileges via leveraging the MSI rollback mechanism. The vulnerability only applies to the Remote Management features: Backup, Monitoring, and Patch Management.
Analysis
CVE-2025-36537 is a local privilege escalation vulnerability in TeamViewer Client (Full and Host) and Tensor prior to version 15.67 on Windows that allows an unprivileged local user to delete arbitrary files with SYSTEM privileges by exploiting improper permission assignment in the MSI rollback mechanism. The vulnerability is limited to Remote Management features (Backup, Monitoring, and Patch Management), has a CVSS score of 7.0, and requires local access with medium attack complexity but no user interaction. This vulnerability represents a significant elevation-of-privilege risk for organizations relying on TeamViewer for remote management.
Technical Context
The vulnerability stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), where the TeamViewer MSI (Microsoft Installer) package does not properly restrict file system permissions during rollback operations. The MSI rollback mechanism, designed to restore system state after failed installations or uninstalls, operates with SYSTEM-level privileges. An unprivileged local user can manipulate or trigger this rollback process to delete critical files with elevated privileges. This affects the Remote Management feature set (Backup, Monitoring, and Patch Management modules) in TeamViewer Remote and TeamViewer Tensor products. The root cause is insufficient validation of file paths and improper ACLs (Access Control Lists) on resources accessed during MSI rollback, allowing privilege escalation from local user context to SYSTEM context.
Affected Products
TeamViewer Remote Client and Host (Full version), versions prior to 15.67 on Windows; TeamViewer Tensor, versions prior to 15.67 on Windows. Specific affected CPE identifiers would be: cpe:2.3:a:teamviewer:teamviewer:*:*:*:*:*:*:*:* (versions <15.67) and cpe:2.3:a:teamviewer:teamviewer_tensor:*:*:*:*:*:*:*:* (versions <15.67). The vulnerability is restricted to Windows operating systems and only impacts installations utilizing Remote Management features (Backup, Monitoring, Patch Management modules). For official patch information and advisory details, consult the TeamViewer Security Advisory at https://www.teamviewer.com/en/resources/security-advisories/ and check your TeamViewer customer portal for version 15.67+ availability.
Remediation
Immediate remediation: (1) Update TeamViewer Remote/Host and TeamViewer Tensor to version 15.67 or later on all Windows systems; (2) Prioritize updates for systems where Remote Management features (Backup, Monitoring, Patch Management) are actively deployed or used by privileged users. Interim mitigations if immediate patching is not feasible: (1) Restrict local system access to trusted users only—implement strong access controls on systems running TeamViewer; (2) Disable Remote Management features if not in active use (Backup, Monitoring, Patch Management); (3) Implement file system monitoring and integrity checking (e.g., Windows File Integrity Monitoring) on critical system directories to detect unauthorized deletions; (4) Use Windows AppLocker or similar application control to restrict execution of MSI-related processes by unprivileged users. For detailed patch availability and download links, visit TeamViewer's official download portal and security advisory page specific to CVE-2025-36537.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today