TeamViewer Hardcoded Shared AES Key Credential Decryption and Privilege Escalation Vulnerability (CVE-2019-18988)

# 1. Terminate and uninstall vulnerable TeamViewer instances
Stop-Process -Name 'TeamViewer' -Force -ErrorAction SilentlyContinue
$app = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like '*TeamViewer*' }
if ($app) { $app.Uninstall() }

# 2. Download and perform a silent installation of the latest secure version
Invoke-WebRequest -Uri 'https://download.teamviewer.com/download/TeamViewer_Setup.exe' -OutFile '$env:TEMP\TeamViewer_Setup.exe'
Start-Process -FilePath '$env:TEMP\TeamViewer_Setup.exe' -ArgumentList '/S' -Wait

# Forcefully remove vulnerable encrypted password registry values
Remove-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\TeamViewer' -Name 'OptionsPasswordAES' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\TeamViewer' -Name 'SecurityPasswordAES' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path 'HKLM:\SOFTWARE\TeamViewer' -Name 'OptionsPasswordAES' -ErrorAction SilentlyContinue
Remove-ItemProperty -Path 'HKLM:\SOFTWARE\TeamViewer' -Name 'SecurityPasswordAES' -ErrorAction SilentlyContinue

# Audit script to detect vulnerable TeamViewer versions and registry keys
$tvPath = 'HKLM:\SOFTWARE\Wow6432Node\TeamViewer'
if (Test-Path $tvPath) {
    $version = (Get-ItemProperty -Path $tvPath -Name 'Version' -ErrorAction SilentlyContinue).Version
    Write-Host 'Detected TeamViewer Version: ' $version
    
    $hasOptionsPwd = (Get-ItemProperty -Path $tvPath -Name 'OptionsPasswordAES' -ErrorAction SilentlyContinue)
    if ($hasOptionsPwd) {
        Write-Warning '[WARNING] Vulnerable OptionsPasswordAES registry key is present! Immediate remediation required.'
    } else {
        Write-Host '[OK] No vulnerable OptionsPasswordAES key found in Wow6432Node.' -ForegroundColor Green
    }
} else {
    Write-Host '[OK] TeamViewer registry path not found.' -ForegroundColor Green
}