The vulnerability is a stack-based buffer overflow in the JSON parsing component of TeamDavid’s Webbox API. An attacker can send a JSON body that is at least 8 characters long and begins with a numeric value, causing a crash and denial of service. If a related vulnerability leaks the stack canary, the overflow could be leveraged to execute arbitrary code and fully compromise the server.

The affected product is Tobit Laboratories AG’s TeamDavid Webbox application, affecting releases up through Rollout 524. All versions preceding that fix remain vulnerable. The application exposes an API endpoint that processes JSON requests.

Based on the description, it is inferred that an unauthenticated attacker can exploit the API endpoint over the network by sending a specially crafted JSON payload. The high CVSS score of 9.5 indicates critical severity while the EPSS score is not reported and the vulnerability is not currently listed in CISA KEV. If the attacker also exploits a separate flaw that reveals the stack canary, the buffer overflow could be used to execute arbitrary code and fully compromise the server.