CVE-2026-54216

The TeamDavid Webbox application exposes an endpoint /internalRestart that allows the server to be shut down. The endpoint is accessible to unauthenticated users over the public internet, and instead of restarting, the server completely shuts down. An attacker can trigger a persistent denial of service, and recovery requires manual administrator intervention.

An API endpoint in the TeamDavid Webbox application is vulnerable to a buffer overflow. Submitting a specially crafted JSON body (at least 8 characters long and starting with a number) by an unauthenticated attacker can cause the server to crash, resulting in denial of service. Depending on stack state or if a stack canary can be disclosed, this buffer overflow could potentially lead to remote code execution and full compromise of the server.

The //serverClient_close.html endpoint in the TeamDavid Webbox application is vulnerable to a buffer overflow in multiple form data parameters. Submitting excessively long values in these parameters by an authenticated attacker can trigger a server crash, resulting in denial of service. Depending on stack state or if a stack canary can be disclosed, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server.

File upload functionalities in the TeamDavid Webbox application are vulnerable to a buffer overflow. Specifying an excessively long filename in a file upload request by an unauthenticated attacker can trigger a crash of the server, resulting in denial of service. Depending on stack state or if a stack canary can be disclosed, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server.

The TeamDavid Webbox application has a memory leak vulnerability that allows an unauthorized actor to read sensitive information. Accessing the URL “/.well-known/mta-sts.” causes the application to respond with memory content. By repeatedly requesting this endpoint, an attacker can access sensitive information, including user passwords. Exploitation does not require authentication.

The TeamDavid Webbox application uses a hard-coded cryptographic key. Passwords for users created locally in David are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server (see vulnerability “Random File Read”), can potentially obtain affected users’ passwords.

Stored XSS vulnerability in TeamDavid Webbox. An attacker can send an email containing malicious JavaScript code, which executes when a user accesses the email.

Open redirect vulnerability in TeamDavid Webbox via the 'replyUrl' parameter. An attacker can craft a URL within the application that redirects the user's browser to an arbitrary third-party site, which can be abused for phishing attacks.

Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the "cType" URL parameter, allowing arbitrary modification of the Content-Type header in HTTP responses. Because the parameter does not properly restrict control characters such as URL-encoded newlines ("%0a") or colons, attackers can inject additional headers including extra Location headers into the server's response, resulting in an open redirect vulnerability. This issue affects TeamDavid through Rollout 524.

The TeamDavid Webbox application handles password changes using a function triggered by including the string "(editini)" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refers to an "Archive.ini" file. If an attacker specifies a different file with excessive size, a buffer overflow occurs. This vulnerability allows an unauthenticated attacker to crash the server, resulting in denial of service.