CVE-2018-16550

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-05 · updated 2026-06-17

Description

TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by skipping the "Cancel" step, which makes it easier to determine the correct value of the default 4-digit PIN.

Affected products

TeamViewer: from 10.0.2551 through 13.2.9356

References

https://twitter.com/vah_13/status/1036894081350291457
https://twitter.com/vah_13/status/1036894081350291457

Get alerted when CVE-2018-16550 or the next vulnerability affects your stack