EUVD-2026-54438
GHSA-ppvf-phq2-5chq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L per network-reachable endpoint; S:C/C:H as NTLM credentials leak to attacker SMB server; PR:L matches official CVSS 4.0 despite ambiguous description.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
1DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts an arbitrary path, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables au-thenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathname” parameter is possible without authentication. This issue affects TeamDavid through Rollout 524.
AnalysisAI
UNC path injection in TeamDavid Webbox's !ArcEntryMove archive function causes the server to initiate outbound SMB connections to attacker-controlled infrastructure, exposing the server's NTLM authentication material (Net-NTLMv2 hashes). All TeamDavid deployments through Rollout 524 are affected, with the confidentiality impact occurring on subsequent systems - the attacker's SMB listener - rather than the Webbox host itself. No public exploit has been identified at time of analysis, but the attack technique is fully commoditized via tools such as Responder and Impacket; exploitation feasibility is further complicated by a contradictory authentication requirement in the source data that warrants vendor clarification.
Technical ContextAI
The affected product is Tobit Laboratories AG's TeamDavid collaboration platform (CPE: cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*), specifically its Webbox web interface. CWE-20 (Improper Input Validation) is the root cause: the pathname parameter of the !ArcEntryMove endpoint accepts arbitrary strings, including UNC notation (\\Server\Share), without sanitization or allowlisting. This is a well-understood forced-authentication or NTLM-coercion pattern - when a Windows-backed server resolves a UNC path, the OS automatically initiates SMB authentication to the specified host using the server process's security context, transmitting Net-NTLMv2 credentials. The CVSS 4.0 vector correctly models this as a subsequent-system confidentiality impact (SC:H) rather than a vulnerable-system impact, because the data exposed (NTLM hashes) is received by the attacker's infrastructure, not leaked from the TeamDavid server's own data stores. Captured hashes can be cracked offline or relayed via Impacket's ntlmrelayx to achieve lateral movement.
RemediationAI
Upgrade TeamDavid beyond Rollout 524 by consulting the vendor release notes at https://david.tobit.software/releasenotes; the specific patched rollout number is not independently confirmed from available references (patch available per vendor advisory - exact fix version not confirmed). If immediate upgrade is not feasible, the most effective compensating control is blocking outbound TCP/UDP port 445 (SMB) from the TeamDavid server to all untrusted or external hosts at the network perimeter - this prevents the server from completing SMB connections to attacker listeners and eliminates the credential capture path, though it will break legitimate outbound SMB functionality if any exists. Enforcing SMB signing on all internal domain controllers and file servers neutralizes the relay attack vector even if hashes are captured, as signed sessions cannot be relayed. Enabling Extended Protection for Authentication (EPA) on services accepting NTLM further hardens the relay surface. If any exploitation is suspected, rotate the service account credentials under which the TeamDavid server process runs. Additional mitigations for related vulnerabilities in this product family may be documented in the infoguard.ch research at https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today