TeamDavid Webbox CVE-2026-54208

No authentication or special privileges are required for the file write phase - the CVSS 4.0 vector (PR:N, AC:L, AT:N) confirms unauthenticated, low-complexity exploitation against any network-reachable Webbox instance. The attacker must have network access to the Webbox web interface. The stored XSS phase additionally requires a victim user to visit or be directed to the attacker-created file URL (UI:P in CVSS 4.0 terms), meaning phishing or social engineering is required to complete the full kill chain. Exploitation is bounded to TeamDavid versions through Rollout 524 - deployments updated beyond this rollout are not affected per the CVE scope. No specific non-default configuration or feature flag is required; the flaw is present in the default Webbox file-handling behavior.

The CVSS 4.0 score of 8.5 is grounded in a credible vector: network-accessible (AV:N), low complexity (AC:L), no authentication (PR:N), no special timing (AT:N), and only passive user interaction (UI:P) to trigger the XSS phase. The file write phase itself requires zero user interaction, meaning the attacker can plant payloads silently; the victim's visit is the only gate. Integrity impact is rated High on both the vulnerable system (VI:H - arbitrary file write) and subsequent systems (SI:H - persistent XSS affecting downstream users). Confidentiality impact is Low on both planes, reflecting that XSS can exfiltrate session tokens but does not grant direct database or OS-level read access. No EPSS score was provided in available data, preventing probabilistic comparison. The vulnerability is not listed in CISA KEV, so active exploitation is not confirmed. However, the unauthenticated write primitive in a product with 21 other known CVEs (per InfoGuard) suggests a weak security baseline that increases the likelihood of chained exploitation. The niche deployment footprint reduces population-level exposure but does not diminish per-instance severity.

An unauthenticated attacker sends a crafted HTTP request to the publicly exposed TeamDavid Webbox endpoint, writing a malicious .htm file containing a JavaScript credential-harvesting payload to a server directory. The attacker then distributes the resulting URL via a phishing email to TeamDavid users; when a recipient clicks the link, the stored JavaScript executes in their browser, silently exfiltrating their session cookie or authentication token to an attacker-controlled server and enabling account takeover. No public proof-of-concept has been identified at time of analysis, but the attack primitive - unauthenticated HTTP request to write an HTML file - requires minimal technical sophistication.