EUVD-2026-54449
GHSA-96qv-r2x5-ffch
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Standalone exploitation requires local filesystem read access to password files, so AV:L and PR:L; no confidentiality impact beyond credentials, no availability impact.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server (see vulnerability “Random File Read”), can potentially obtain affected users’ passwords. This issue affects TeamDavid through Rollout 524.
AnalysisAI
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side password files - via direct filesystem access or through the companion 'Random File Read' vulnerability - to reverse the obfuscation applied to locally-created user passwords and recover plaintext credentials. All TeamDavid deployments through Rollout 524 using locally created accounts are affected, making this a critical identity compromise risk for organizations relying on TeamDavid as an M365 alternative. No public exploit has been independently confirmed, but InfoGuard Labs published a 22-CVE research campaign against this product that likely includes technical detail enabling exploitation.
Technical ContextAI
CWE-321 (Use of Hard-coded Cryptographic Key) describes a class of flaws where a fixed, embedded key is used in place of properly managed cryptographic secrets. In this case, Tobit TeamDavid stores passwords for locally created users across various files protected only by obfuscation - a reversible transformation dependent on a hard-coded key baked into the application binary or configuration. Obfuscation is not encryption: anyone who recovers the static key (by reverse-engineering the application) can trivially decode any intercepted password file. The affected component is the Webbox module of TeamDavid, identified via CPE cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*. This vulnerability is explicitly linked in the description to a companion 'Random File Read' vulnerability within the same product, which provides the file extraction primitive needed to make this credential disclosure remotely exploitable. The combination constitutes a two-stage credential theft chain without requiring authenticated access.
RemediationAI
Upgrade TeamDavid beyond Rollout 524 by consulting the vendor release notes at https://david.tobit.software/releasenotes to identify the patched rollout version - an upstream fix is indicated but an exact fixed rollout number is not independently confirmed from the available references. For deployments that cannot immediately upgrade, restrict filesystem access to the server to the minimum necessary set of accounts and ensure the companion 'Random File Read' vulnerability (separately catalogued in the InfoGuard Labs disclosure at https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/) is also remediated, as it is the primary remote delivery path for exploiting this credential exposure. As a compensating control, consider migrating locally created David accounts to externally managed directory authentication (e.g., Active Directory or LDAP integration) where passwords are not stored locally in David's file-based format - note this may require reconfiguration and user re-provisioning. Additionally, audit existing locally created accounts for password reuse against other internal systems and force credential resets for all affected accounts, since any prior filesystem exposure (through logs, backups, or the Random File Read vector) may have already resulted in credential theft.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today