EUVD-2026-54450
GHSA-8rw4-wgvv-9v82
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint with low-privilege per contradictory description; scope change to subsequent systems via NTLM relay drives C:H and S:C, with I:L reflecting relay-enabled writes on downstream targets.
Primary rating from Vendor (NCSC.ch).
CVSS VectorVendor: NCSC.ch
Lifecycle Timeline
1DescriptionCVE.org
Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm) accepts a “pathname” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables authenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathname” parameter is possible without authentication. This issue affects TeamDavid through Rollout 524.
AnalysisAI
UNC path injection in Tobit TeamDavid's Webbox link-storing endpoint (//ServerClient_celink.htm) forces the server to initiate outbound SMB connections to attacker-controlled hosts, leaking NTLM authentication credentials and enabling SMB relay attacks against internal systems. The unvalidated pathname parameter accepts arbitrary UNC paths (e.g., \\attacker\share), triggering Windows credential-passing behavior that exposes the server's NTLM hash. No public exploit code identified at time of analysis, though the underlying NTLM coercion technique is well-understood and documented as part of a broader audit of 22 CVEs in the David platform published by InfoGuard.
Technical ContextAI
The vulnerability exists in the Webbox component of Tobit Laboratories AG's TeamDavid collaboration platform (CPE: cpe:2.3:a:tobit_laboratories_ag:teamdavid:*:*:*:*:*:*:*:*), a self-described secure Microsoft 365 alternative. CWE-20 (Improper Input Validation) is the root cause: the pathname parameter accepted by //ServerClient_celink.htm is passed directly to server-side path resolution logic without sanitizing or rejecting UNC-style paths. On Windows, resolving a UNC path like \\attacker-server\share triggers the OS to initiate an SMB authentication handshake to the named host, transparently passing the server's NTLM credentials. This class of flaw - sometimes called NTLM coercion - shares conceptual lineage with PetitPotam and PrinterBug, where a server-side API or endpoint can be weaponized to force outbound authenticated SMB connections. Successful exploitation beyond hash capture depends on whether outbound port 445 is reachable and whether SMB signing is enforced on downstream targets.
RemediationAI
Upgrade TeamDavid to a rollout version beyond Rollout 524 per the vendor release notes at https://david.tobit.software/releasenotes; the exact patched rollout number is not independently confirmed from available input data and should be verified there directly. As an immediate compensating control, block all outbound connections on port 445 (SMB) at both the network perimeter and host-based firewall on the TeamDavid server - this prevents credential exfiltration even if the injection flaw is triggered, with the trade-off of potentially blocking legitimate SMB functionality if the server relies on it. Enforce SMB signing on all internal systems to neutralize relay attacks even when outbound SMB is reachable; unsigned SMB is the precondition for relay-based lateral movement. Where feasible, restrict or disable NTLM authentication in favor of Kerberos to eliminate the credential class at risk. Enable Extended Protection for Authentication on services that accept NTLM to further limit relay targets.
Denial of service with potential for remote code execution affects Tobit Laboratories' TeamDavid (David Webbox) groupwar
Denial of service, and potentially remote code execution, in Tobit Laboratories' David (TeamDavid/Webbox) collaboration
Denial of service (with conditional remote code execution potential) affects Tobit Laboratories AG's TeamDavid groupware
Persistent denial of service in Tobit Laboratories AG's TeamDavid (David/Webbox groupware) allows any remote, unauthenti
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote att
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attacker
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthentic
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privi
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rol
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today