EUVD-2026-54443
GHSA-3pfv-fvh9-ffrp
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The crash is trivially reachable unauthenticated over the network (AV:N/AC:L/PR:N), so I score the reliable DoS impact (A:H); RCE affecting C/I is only conditional on a chained canary leak and is not scored in the base.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially crafted JSON body, such as one that is at least 8 characters long and begins with a number, an unauthenticated attacker can cause the server to crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially lead to remote code execution and full compromise of the server. This issue affects TeamDavid through Rollout 524.
AnalysisAI
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupware through Rollout 524, where an unauthenticated attacker can crash the server by sending a specially crafted JSON body to a vulnerable API endpoint - a payload as small as 8 characters beginning with a number triggers an out-of-bounds stack write. The reliably reachable impact is a server crash, but the underlying buffer overflow could escalate to full server compromise if a stack canary is disclosed via a separate vulnerability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Reliable exploitation for denial of service requires only network access to the vulnerable TeamDavid Webbox API endpoint and the ability to send a crafted JSON body - specifically a payload at least 8 characters long that begins with a numeric character - against any TeamDavid instance through Rollout 524; no authentication (PR:N) and no user interaction (UI:N) are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, score 9.5) scores the theoretical worst case - full confidentiality, integrity and availability loss via RCE - but the description itself qualifies that outcome as conditional ('could potentially lead to remote code execution... … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a Rollout newer than 524 as published by the vendor; no exact fixed version is provided in the supplied intelligence, so consult Tobit's release notes at https://david.tobit.software/releasenotes and the InfoGuard advisory at https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ to identify and apply the specific patched Rollout. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all TeamDavid instances running Rollout 524 or earlier and immediately restrict network access to this application-limit to known internal users only and disable any internet-facing endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today