SMB Relay Vulnerability in Tobit Laboratories AG TeamDavid's Webbox
CVE-2026-54205

6.3MEDIUM

Key Information:

Vendor

Tobit Laboratories Ag

Status
Teamdavid
Vendor
CVE Published:
7 August 2026

What is CVE-2026-54205?

The link storing feature in Tobit Laboratories AG's TeamDavid's Webbox lacks proper validation for the 'pathname' parameter, allowing authenticated users to input UNC paths. This vulnerability can lead to unauthorized outbound connection attempts to attacker-controlled SMB servers. When exploited, it could enable attackers to authenticate to arbitrary SMB endpoints, leading to the exposure of sensitive NTLM authentication information. Without authentication, attackers can leverage this weakness to mount SMB relay or credential theft attacks, especially if outbound connections to port 445 are permitted.

Affected Version(s)

TeamDavid 0

References

https://david.tobit.software/releasenotes
release-notes
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dario Weiss of InfoGuard Labs
.