CVE-2020-13699 in the critical feed json
TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers.
published 2020-07-29 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-5921
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 25.8%
- EPSS 25.8% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Metasploit
Summary
TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated by a teamviewer10: --play URL. An attacker could force a victim to send an NTLM authentication request and either relay the request or capture the hash for offline password cracking. This affects teamviewer10, teamviewer8, teamviewerapi, tvchat1, tvcontrol1, tvfiletransfer1, tvjoinv8, tvpresent1, tvsendfile1, tvsqcustomer1, tvsqsupport1, tvvideocall1, and tvvpn1. The issue is fixed in 8.0.258861, 9.0.258860, 10.0.258873, 11.0.258870, 12.0.258869, 13.2.36220, 14.2.56676, 14.7.48350, and 15.8.3.
Patch / fix
- teamviewer teamviewer 15.8.3
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-21-308-01 updated cvss 5.3
VISAM VBASE Editor
-
VISAM VBASE Pro-RT/ Server-RT (Web Remote) 11.6.0.6affected: mitigation “VISAM recommends users update to VBASE v11.7.0.2 or later. Users may obtain a download link by submitting a request form.” vbase.net
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
Exploit prediction
25.79% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/server/teamviewer_uri_smb_redirect TeamViewer Unquoted URI Handler SMB Redirect metasploit auxiliary, normal rank
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-88 Improper Neutralization of Argument Delimiters in a Command
References
-
community.teamviewer.com
/t5/Announcements/Statement-on-CVE-2020-13699/td-p/98448
vendor-advisory
-
jeffs.sh
/CVEs/CVE-2020-13699.txt
third-party-advisory
Sources
- CVE List CVE-2020-13699
- NVD CVE-2020-13699
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.