The vulnerability is a classic stack buffer overflow present in the Webbox application’s endpoint //serverClient_close.html. An authenticated attacker can supply excessively large values in form data parameters, causing the server to crash and leading to denial of service. If, in addition, a stack canary can be disclosed via another vulnerability or the stack state is manipulated, this overflow could be leveraged to execute arbitrary code on the server, potentially resulting in full compromise.

This flaw affects the TeamDavid Webbox application from Tobit Laboratories AG before Rollout 528. The vulnerability resides in the endpoint that handles server shutdown requests, which is accessible only to authenticated users with the appropriate permissions. In Rollout 528 and later the affected functionality is disabled by default, so the vulnerability is no longer exposed.

The CVSS score of 9.5 indicates a critical severity. The EPSS score of 0.0041 indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires authenticated access and the ability to submit long form data, making exploitation likely easier in environments where users create accounts or where credential exposure is possible. Without a stack canary leak, the primary impact is a denial of service. If a stack canary can be bypassed, remote code execution could be achieved, which would be catastrophic for the affected servers.