EUVD-2026-54440
GHSA-4x8q-mprg-xpmc
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Trigger is entirely attacker-controlled with no external conditions, so AC:L; no auth or interaction needed; impact is DoS-only with no scope change.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "(editini)" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refers to an "Archive.ini" file. If an attacker specifies a different file with excessive size, a buffer overflow occurs. This vulnerability allows an unauthenticated attacker to crash the server, resulting in denial of service. This issue affects TeamDavid through Rollout 524.
AnalysisAI
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attackers to crash the server by crafting an HTTP password-change request with a non-INI target file of excessive size. The handler activates solely on the presence of the string "(editini)" in the request path with no further validation, triggering a buffer overflow that terminates the server process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trigger mechanism is fully detailed in the InfoGuard coordinated disclosure.
Technical ContextAI
TeamDavid (CPE: cpe:2.3:a:tobit_laboratories_ag:teamdavid) is a Microsoft 365 alternative groupware platform developed by Tobit Laboratories AG. Its Webbox component is an HTTP-facing application that includes a password-change routine activated by a magic string sentinel - "(editini)" - appearing anywhere in the URL file path parameter. When triggered, the function writes the supplied password to a caller-specified INI file path without verifying that the path actually resolves to an "Archive.ini" file or that the path string is within an expected size bound. Supplying a path to a non-INI file of excessive length causes a buffer overflow and crashes the server process. The assigned CWE is CWE-125 (Out-of-bounds Read), though the description characterizes the bug as a write-side overflow, which aligns more precisely with CWE-120/CWE-122; this classification discrepancy should be verified with the vendor or InfoGuard (https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/), where this CVE is one of 22 coordinated findings in the same product.
RemediationAI
Upgrade TeamDavid to a rollout version beyond Rollout 524 per vendor release notes at https://david.tobit.software/releasenotes; an exact patched rollout number is not confirmed from available input data - verify the minimum fixed version directly with Tobit Laboratories AG or the InfoGuard advisory before assuming any specific release is safe. If an immediate upgrade is not feasible, restrict network access to the Webbox application at the perimeter or host-based firewall to trusted internal clients only, which prevents unauthenticated remote exploitation but disables external Webbox access as a side effect. A targeted compensating control is to deploy a WAF or reverse proxy rule that blocks or rejects HTTP requests containing the literal string "(editini)" in the URL path; this disrupts the specific trigger mechanism with minimal impact on other TeamDavid functionality, though it does not address the underlying memory-safety defect and should not be treated as a permanent substitute for patching. Consult the full InfoGuard disclosure at https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ for context on the broader vulnerability set in this product.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today