CVE-2020-13699 affected TeamViewer Desktop for Windows before specific fixed releases in versions 8 through 15. TeamViewer did not correctly quote arguments passed through its registered custom URI handlers. A malicious page could invoke a URI such as teamviewer10: --play with a UNC path, causing Windows to send an NTLM authentication request to an attacker-controlled SMB server. The attacker could capture the challenge-response for offline cracking or attempt relay where the destination and protections permitted it. This was credential coercion through TeamViewer's URI handling, not direct remote code execution in TeamViewer.
# defensive verification: identify the installed TeamViewer version
(Get-Item 'C:\Program Files\TeamViewer\TeamViewer.exe').VersionInfo.ProductVersion
# compare the relevant major release with the fixed versions in CVE-2020-13699
Exploitation notes#
- Exploitation requires the vulnerable Windows client to process a crafted URI, typically through user interaction with a malicious page or link.
- The immediate result is an outbound NTLM authentication attempt. Any further effect depends on password strength and whether NTLM relay is possible; see NTLM relay.
- Fixed releases differ by TeamViewer major version, so compare the complete installed version with the CVE record rather than using a single global threshold.
- Do not generalize this CVE into an unspecified parsing or remote-code-execution class.