Description
Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts
an arbitrary path, which can be set to network locations using UNC paths
(e.g., “\\Server\Share”). The server processes these paths without
validation, resulting in outbound connection attempts to
attacker-controlled SMB servers. This enables au-thenticated attackers
to trigger the server to authenticate to arbitrary SMB endpoints,
potentially exposing NTLM authentication information (such as NTLM
hashes). If outbound connections to port 445 (SMB) are permitted,
attackers can use this to conduct SMB relay or credential theft attacks.
Exploitation of the “pathname” parameter is possible without
authentication. This issue affects TeamDavid before Rollout 528.

Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
Published: 2026-08-07
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Credential Theft via SMB Relay
Action: Upgrade or Disable
AI Analysis

Impact

TeamDavid Webbox move archive functionality accepts an arbitrary pathname. Without validation, an attacker can supply a UNC path such as \\Server\Share. The server then attempts an outbound SMB connection over TCP/445 when processing the request. This allows the host to authenticate to an attacker‑controlled SMB server, potentially exposing NTLM credentials. The flaw originates from improper input validation (CWE-20) and server‑side request forgery (CWE-918).

Affected Systems

Affected product is Tobit Laboratories AG TeamDavid Webbox, all releases before Rollout 528 (June 30 2026). The issue exists in the !ArcEntryMove endpoint. Starting with Rollout 528 the functionality is disabled by default, removing the exposed path. The vulnerability can be triggered without authentication via the endpoint.

Risk and Exploitability

CVSS score 6.3 indicates moderate severity. EPSS < 1%, suggesting low exploitation probability. It is not listed in the CISA KEV catalog. The attack requires network connectivity to TCP/445; if outbound SMB is blocked, exploitation is limited. Because the endpoint can be used without authentication, any host can send the request, increasing potential reach. Successful exploitation could result in credential theft and SMB relay that may enable further lateral movement.

Generated by OpenCVE AI on September 7, 2026 at 16:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Deploy a TeamDavid Webbox build that is Rollout 528 or newer, where the vulnerable functionality is disabled by default.
  • If the system cannot be updated immediately, turn off or restrict the move archive feature to prevent the pathname parameter from pointing to external UNC paths.
  • Block outbound SMB traffic (TCP/445) from the TeamDavid Webbox to external hosts via network segmentation or firewall rules, preventing credential leakage and relay attacks.

Generated by OpenCVE AI on September 7, 2026 at 16:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 07 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
References

Mon, 07 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Description Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts an arbitrary path, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables au-thenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathname” parameter is possible without authentication. This issue affects TeamDavid through Rollout 524. Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts an arbitrary path, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables au-thenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathname” parameter is possible without authentication. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
References

Sat, 08 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Tobit Laboratories Ag
Tobit Laboratories Ag teamdavid
Vendors & Products Tobit Laboratories Ag
Tobit Laboratories Ag teamdavid

Fri, 07 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
Description Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts an arbitrary path, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables au-thenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathname” parameter is possible without authentication. This issue affects TeamDavid through Rollout 524.
Title TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality
Weaknesses CWE-20
CWE-918
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Tobit Laboratories Ag Teamdavid
cve-icon MITRE

Status: PUBLISHED

Assigner: NCSC.ch

Published:

Updated: 2026-09-07T12:49:39.464Z

Reserved: 2026-06-12T09:32:44.532Z

Link: CVE-2026-54207

cve-icon Vulnrichment

Updated: 2026-08-07T14:46:19.764Z

cve-icon NVD

Status : Deferred

Published: 2026-08-07T10:16:57.610

Modified: 2026-09-07T13:20:27.853

Link: CVE-2026-54207

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T16:45:17Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-918

    Server-Side Request Forgery (SSRF)