The vulnerability is a classic stack buffer overflow present in the Webbox application’s endpoint //serverClient_close.html. An attacker who is authenticated can supply excessively large values in form data parameters, causing the server to crash and resulting in a denial of service. If an attacker also obtains a stack canary disclosure or can influence the stack state, the overflow could be leveraged to execute arbitrary code on the server, potentially leading to full compromise.

This flaw affects the TeamDavid Webbox application from Tobit Laboratories AG, specifically affecting Rollout 524 and earlier versions. The vulnerability exists in the endpoint that handles server shutdown requests, accessible to authenticated users with the appropriate permissions.

The CVSS score of 9.5 indicates a critical severity. No EPSS data is publicly available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires authenticated access and the ability to submit long form data, making exploitation likely easier in environments where users create accounts or where credential exposure is possible. Without a stack canary leak, the primary impact is a denial of service. If a stack canary can be bypassed, remote code execution could be achieved, which would be catastrophic for the affected servers.