EUVD-2026-54437
GHSA-9q86-rqgf-5jcm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVE description confirms unauthenticated pathname exploitation (PR:N); NTLM hash leakage to attacker-controlled host constitutes scope change with high subsequent-system confidentiality impact.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
1DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables authenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathname” parameter is possible without authentication. This issue affects TeamDavid through Rollout 524.
AnalysisAI
UNC path injection in Tobit Laboratories AG TeamDavid's Webbox messaging component allows attackers to coerce the server into initiating outbound SMB connections to attacker-controlled hosts, exposing NTLM authentication credentials. The server processes @@INCLUDE directives containing Windows UNC paths (e.g., \\Server\Share) without validation across email, fax, and SMS composition features. Captured NTLM hashes can be cracked offline or relayed to authenticate against other internal services; the CVE description explicitly states the pathname parameter vector is exploitable without authentication, conflicting with the PR:L designation in the CVSS 4.0 vector. No public exploit or CISA KEV listing has been identified at time of analysis, but this attack class (NTLM coercion via UNC injection) is well-understood and widely tooled.
Technical ContextAI
The affected product is Tobit Laboratories AG TeamDavid Webbox, identified by CPE cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*, a Microsoft 365-positioned alternative offering email, fax, and SMS functionality. The @@INCLUDE command is a server-side templating directive processed during message composition. When supplied a UNC path (Universal Naming Convention, e.g., \\attacker.host\share), the underlying Windows server OS resolves the path by initiating an SMB authentication handshake on TCP port 445, transmitting the NTLM challenge-response of the server's machine or service account to the attacker-controlled endpoint. CWE-20 (Improper Input Validation) is the root cause: the application fails to restrict @@INCLUDE targets to local or trusted paths, treating user-controlled network locations as valid include sources. This is structurally a Server-Side Request Forgery (SSRF) variant specific to the SMB protocol, enabling NTLM hash capture (for offline cracking) or SMB relay attacks (for lateral movement) when outbound port 445 is not filtered.
RemediationAI
The primary fix is to upgrade TeamDavid beyond Rollout 524; however, a specific patched rollout number is not confirmed in available data - consult the vendor release notes at https://david.tobit.software/releasenotes for the current fixed version. As an immediate compensating control, block all outbound TCP connections on port 445 (SMB) from the TeamDavid server at the network perimeter firewall and host-based firewall; this prevents NTLM hash exfiltration even if the @@INCLUDE directive is triggered, though it may break any legitimate SMB file-share integration the server relies upon. Additionally, configure network egress rules to prevent the server from reaching arbitrary internet or intranet SMB endpoints, limiting relay attack surface. Where possible, run the TeamDavid service under a minimally-privileged, non-domain account so that any captured NTLM credentials have reduced lateral movement value. WAF-level filtering to strip or reject @@INCLUDE directives containing UNC path patterns (matching \\) in messaging requests provides an additional detection and prevention layer.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today