CVE-2026-54213
CriticalCVSS 9.2Summary
The TeamDavid Webbox application exposes an endpoint /internalRestart that allows the server to be shut down. The endpoint is accessible to unauthenticated users over the public internet, and instead of restarting, the server completely shuts down. An attacker can trigger a persistent denial of service, and recovery requires manual administrator intervention.
Risk Assessment
The risk is the ability to remotely shut down the server without authentication, leading to service disruptions and requiring manual administrator intervention to restore operations.
Recommendation
It is recommended to restrict access to the /internalRestart endpoint to authenticated and authorized users only, and to implement monitoring and alerts for attempts to exploit it.
Original NVD description (English source)
Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart) is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of “restarting”, the server shuts completely down. As a result, a remote attacker can trigger a persistent denial of service by shutting down the web server without requiring authentication. Recovery requires manual administrator intervention to restart the service. This issue affects TeamDavid through Rollout 524.