Tobit David CVE-2026-54203

The specific prerequisite is network reachability to the David Webbox HTTP service and the ability to request the exact malformed URL path "/.well-known/mta-sts." (the trailing-dot / truncated MTA-STS discovery path); no authentication, credentials, or user interaction are required per CVSS PR:N/UI:N. Exploitation is probabilistic - each request returns whatever memory happens to be present, so an attacker must send many requests to capture useful secrets like passwords, and success depends on sensitive data being resident in the leaked memory region at request time. The limiting factors are: the David/TeamDavid Webbox interface must be reachable from the attacker's network position (internet-facing deployments are fully at risk; internal-only deployments limit exposure to insiders or pivoted attackers), and the instance must be at Rollout 524 or earlier.

All available signals point to genuine, exploitable risk rather than a paper-only high score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, low-complexity, unauthenticated exploitation with no user interaction and high confidentiality impact (VC:H, SC:H), yielding 9.2 Critical. No EPSS score, KEV entry, or SSVC decision data was provided, so exploitation-in-the-wild probability cannot be quantified - treat the absence of KEV as 'not confirmed exploited,' not as 'safe.' No public exploit identified at time of analysis; however, the technique (repeatedly GET a single fixed URL) is trivial to weaponize once the endpoint is public knowledge, so real-world risk should be assumed higher than the missing EPSS/POC data implies. The main mitigating factor is deployment scale: David is a niche product, so impact is contained to organizations running it, but for those organizations password exposure is a severe, low-effort compromise.

An unauthenticated attacker who can reach an internet-exposed David Webbox scripts a loop that repeatedly issues GET requests to "/.well-known/mta-sts." and parses each response for memory fragments. Over many requests they accumulate leaked buffers containing other users' credentials, then reuse a recovered password to log into the David mail/groupware environment. Given AV:N/AC:L/PR:N/UI:N the attack needs only network reachability and can be fully automated; no public POC has been identified, but the technique is straightforward to reproduce.