Tobit Laboratories AG TeamDavid's Webbox Vulnerability in Network Communication

CVE-2026-54206

What is CVE-2026-54206?

A vulnerability exists in Tobit Laboratories AG's TeamDavid's Webbox allowing authenticated attackers to exploit the application's mail, fax, and SMS functionalities through an insecure command input. This involves the use of the @@INCLUDE command that accepts UNC path specifications, leading the server to initiate outbound connections to potentially malicious SMB servers. Such behavior, coupled with the application's failure to validate these paths, puts sensitive NTLM authentication information at risk. If the server is permitted to connect over port 445, attackers could exploit this to carry out SMB relay or credential theft attacks, compromising the security of the affected systems.

References