CVE-2026-54209

The Webbox application by Tobit Laboratories AG TeamDavid exposes a functionality that allows the server to be shut down when accessing the /internalRestart endpoint. This endpoint is accessible to unauthenticated users over the public internet. Instead of restarting, the server shuts down completely, enabling a remote attacker to cause persistent denial of service without authentication.

The Webbox application by Tobit Laboratories AG TeamDavid has an API endpoint vulnerable to a buffer overflow. By submitting a specially crafted JSON body, an unauthenticated attacker can crash the server, resulting in denial of service. Depending on stack state, this could potentially lead to remote code execution and full server compromise.

The Webbox application by Tobit Laboratories AG TeamDavid has an endpoint //serverClient_close.html vulnerable to a buffer overflow in multiple form data parameters. By submitting excessively long values, an authenticated attacker can crash the server, causing denial of service. This could potentially be exploited for remote code execution and full server compromise.

The Webbox application by Tobit Laboratories AG TeamDavid has file upload functionalities vulnerable to a buffer overflow. Specifying an excessively long filename can crash the server, causing denial of service. This could potentially be exploited for remote code execution and full server compromise.

The Webbox application by Tobit Laboratories AG TeamDavid has a memory leak vulnerability to an unauthorized actor. Accessing the URL “/.well-known/mta-sts.” causes the application to respond with memory. Repeated requests can expose sensitive information, including user passwords. Exploitation does not require authentication.

Tobit Laboratories AG TeamDavid's Webbox uses a hard-coded cryptographic key vulnerability. Passwords for locally created users in David are stored in various files using only obfuscation, so any user with access to the server's file system or who can extract files can potentially obtain affected users' passwords.

Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the payload to execute in the victim’s browser when they click the link. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the “cType” URL parameter, which allows arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines (“%0a”) or colons, attackers can inject additional headers including extra Location headers into the server’s response. This results e.g. in an open redirect vulnerability. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is written directly to files without proper validation or restriction on file types. As a result, an attacker can create files (e.g., .htm) containing malicious JavaScript code. When a user accesses a file created in this way, stored cross-site scripting is triggered. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed.

Tobit Laboratories AG TeamDavid's Webbox's move archive functionality (“!ArcEntryMove”) accepts an arbitrary path, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables authenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathname” parameter is possible without authentication. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.