CVE-2026-54203
CriticalCVSS 9.2Summary
The TeamDavid Webbox application has a memory leak vulnerability that allows an unauthorized actor to read sensitive information. Accessing the URL “/.well-known/mta-sts.” causes the application to respond with memory content. By repeatedly requesting this endpoint, an attacker can access sensitive information, including user passwords. Exploitation does not require authentication.
Risk Assessment
The risk includes the possibility of unauthorized reading of sensitive data, including user passwords, which can lead to confidentiality breaches and further attacks.
Recommendation
It is recommended to apply vendor patches immediately and restrict access to the /.well-known/mta-sts. endpoint. Also, monitor logs for unusual requests to this endpoint.
Original NVD description (English source)
Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds with memory. By repeatedly requesting this endpoint, an attacker can access sensitive information, including user passwords. Exploitation does not require authentication. This issue affects TeamDavid through Rollout 524.