EUVD-2026-54442
GHSA-m98g-956p-4hxc
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint but description requires an authenticated user (PR:L); confirmed impact is DoS (A:H) while RCE is canary/chain-dependent (AC:H), so C/I only Low.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid through Rollout 524.
AnalysisAI
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware through Rollout 524, where the Webbox endpoint "//serverClient_close.html" fails to bounds-check multiple form-data parameters. An attacker submitting over-long parameter values triggers an out-of-bounds write (CWE-787) that crashes the server; if a stack canary can be leaked via a separate flaw, the memory corruption could escalate to full server compromise. No public exploit identified at time of analysis, and this CVE is one of 22 reported in the David platform by researchers at InfoGuard/NCSC.ch.
Technical ContextAI
TeamDavid is Tobit Laboratories' David groupware/messaging suite, marketed as a self-hosted Microsoft 365 alternative; the affected component is its web-facing 'Webbox' HTTP interface. The root cause is CWE-787 (Out-of-bounds Write): the handler for the "//serverClient_close.html" endpoint copies attacker-supplied form-data parameter values into fixed-size stack buffers without validating length, so excessively long inputs overrun the buffer and corrupt adjacent stack memory. Because the overflow is on the stack, exploitation beyond a crash depends on stack layout and defenses - the description explicitly notes that reaching code execution would require defeating or disclosing a stack canary, likely by chaining a separate information-disclosure bug. The single CPE (cpe:2.3:a:tobit_laboratories_ag:teamdavid:*) confirms all versions up to the fixed rollout are in scope.
RemediationAI
Upgrade to a Tobit David/TeamDavid rollout newer than Rollout 524 as published on the vendor release-notes page (https://david.tobit.software/releasenotes); an exact patched rollout number is not stated in the provided data, so confirm the fixed build directly with Tobit before deploying. Until patched, restrict network reachability of the Webbox HTTP interface to trusted management networks or VPN, and specifically block or proxy-filter requests to the "//serverClient_close.html" endpoint (or drop requests with abnormally long form-data parameters) at a reverse proxy or WAF - noting this may break legitimate client-close functionality and must be validated against normal client behavior. Because exploitation per the description requires an authenticated session, tighten account provisioning and monitor Webbox authentication logs and unexpected service restarts as a detective control. Reference the InfoGuard Labs advisory (https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/) for the broader set of David vulnerabilities that should be remediated together.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today