EUVD-2026-54443
GHSA-3pfv-fvh9-ffrp
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The crash is trivially reachable unauthenticated over the network (AV:N/AC:L/PR:N), so I score the reliable DoS impact (A:H); RCE affecting C/I is only conditional on a chained canary leak and is not scored in the base.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
2DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially crafted JSON body, such as one that is at least 8 characters long and begins with a number, an unauthenticated attacker can cause the server to crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially lead to remote code execution and full compromise of the server. This issue affects TeamDavid through Rollout 524.
AnalysisAI
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupware through Rollout 524, where an unauthenticated attacker can crash the server by sending a specially crafted JSON body to a vulnerable API endpoint - a payload as small as 8 characters beginning with a number triggers an out-of-bounds stack write. The reliably reachable impact is a server crash, but the underlying buffer overflow could escalate to full server compromise if a stack canary is disclosed via a separate vulnerability. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; the high CVSS 4.0 base score (9.5) reflects the worst-case RCE potential rather than confirmed code execution.
Technical ContextAI
TeamDavid is the Webbox/API component of Tobit Laboratories' David groupware suite, marketed as a Microsoft 365 alternative for mail, messaging and collaboration. The flaw is classified as CWE-787 (Out-of-bounds Write): the API endpoint that parses incoming JSON request bodies fails to bound-check input before writing it into a fixed-size stack buffer, so a malformed value (notably one at least 8 characters long starting with a numeric character) overruns the buffer and corrupts adjacent stack memory. Corrupting the saved return address or other control data causes an immediate crash; in principle the same primitive permits control-flow hijacking, but reliable exploitation is gated by stack protections (canaries/ASLR) that would need to be bypassed through an additional information-disclosure bug. The single CPE cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:* covers all versions up to and including Rollout 524.
RemediationAI
Upgrade to a Rollout newer than 524 as published by the vendor; no exact fixed version is provided in the supplied intelligence, so consult Tobit's release notes at https://david.tobit.software/releasenotes and the InfoGuard advisory at https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/ to identify and apply the specific patched Rollout. Until a patched release is deployed, restrict network reachability of the Webbox API endpoint by placing it behind a VPN or firewall so it is not exposed to the untrusted internet, and if a WAF or reverse proxy is available, reject or rate-limit malformed and oversized JSON request bodies to the affected endpoint (trade-off: strict body validation may break legitimate clients that send large payloads, and network restriction reduces remote accessibility for external users). Monitor the service for unexpected crashes or restarts as an indicator of exploitation attempts, and do not rely on stack canaries alone, since the vulnerability class can still cause reliable DoS even when RCE is prevented.
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Unauthenticated log file exposure in the Webbox component of Tobit Laboratories AG TeamDavid allows remote attackers to
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today