Some remote-desktop products support temporary session passwords, configured unattended-access passwords, account-based access, or passwordless device assignment. A weak, reused, or disclosed password can permit unauthorized access when it is the applicable authentication factor, but its exposure and guessability depend on the exact configuration. TeamViewer Classic, for example, supports random passwords of 6, 8, or 10 characters and applies increasing delays to failed connection attempts. CVE-2018-16550 documented a historical brute-force concern and must not be generalized to every TeamViewer or remote-desktop release.
# authorized assessment checklist
# - identify the active access method and password policy
# - verify rate limiting, lockout, approval, allowlist, and MFA controls
# - test only within the agreed attempt limits
Exploitation notes#
- A valid password and device ID may still be constrained by interactive approval, allowlists, multifactor authentication, account assignment, and permission profiles.
- Evaluate temporary and unattended credentials separately: they can have different lifetimes, policies, and secondary controls.
- Do not infer online-guessing feasibility from password length alone. Measure product-specific throttling or lockout only during an authorized test.
- Unattended access can provide recurring entry when valid reusable authentication material is obtained; see unattended access.