Skip to main content

Improper Resource Shutdown or Release

CVE-2022-23242

Medium
6.3/10

Summary

TeamViewer Linux versions before 15.28 do not properly execute a deletion command for the connection password in case of a process crash. Knowledge of the crash event and the TeamViewer ID as well as either possession of the pre-crash connection password or local authenticated access to the machine would have allowed to establish a remote connection by reusing the not properly deleted connection password.

  • HIGH
  • LOCAL
  • HIGH
  • UNCHANGED
  • REQUIRED
  • HIGH
  • HIGH
  • HIGH

CWE-404 - Improper Resource Shutdown or Release

The program does not release or incorrectly releases a resource before it is made available for re-use.

References

Advisory Timeline

  • Published