TeamDavid Webbox CVE-2026-54201

The TeamDavid Webbox interface must be network-reachable by the attacker - either internet-exposed or accessible from within the attacker's network segment. No authentication, special configuration, non-default feature enablement, or user interaction is required; the CVSS 4.0 vector (PR:N/AC:L/AT:N/UI:N) confirms exploitation against default configurations. The primary limiting factor is network reachability: organizations that restrict Webbox access to internal networks or VPN-only segments significantly reduce exposure. Exploitation yields only log file content (information disclosure) and does not directly enable code execution, data modification, or denial of service.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity, network-accessible exploitation with no preconditions - the worst-case access profile. However, the impact metrics (VC:L/VI:N/VA:N/SC:L) cap real-world harm at limited information disclosure; no integrity or availability impact is present. The official score of 6.9 reflects this partial impact ceiling. No CISA KEV listing exists and no public exploit code has been identified, suggesting no active mass exploitation at time of analysis. This vulnerability is best categorized as a meaningful reconnaissance enabler - log contents could reveal credentials, session data, internal architecture, or peer system addresses, directly lowering the cost of follow-on attacks. The risk is therefore higher in practice than the CVSS impact metrics alone suggest, particularly for organizations where TeamDavid is internet-exposed. The lack of KEV listing and POC keeps this as a prioritized-but-not-emergency remediation for most deployments.

An unauthenticated attacker with network access to a TeamDavid Webbox instance sends a direct HTTP GET request to the exposed log file endpoint, receiving a response containing application error logs, stack traces, or internal configuration details with no credential challenge. The attacker parses these logs to extract internal hostnames, API patterns, or session artifacts, then uses that intelligence to craft targeted follow-on attacks against the TeamDavid environment or connected systems.