Tobit Laboratories AG’s TeamDavid Webbox is vulnerable to HTTP header injection through the "cType" URL parameter. The parameter is not sanitized for control characters such as URL‑encoded newlines ("%0a") or colons, allowing attackers to inject arbitrary HTTP headers, including additional Location headers. This flaw can be abused to redirect victims to malicious sites, effectively creating an open redirect vulnerability. The impact is a compromise of user experience and potential phishing attacks, but it does not grant direct system compromise or data exfiltration.

The affected product is Tobit Laboratories AG TeamDavid, specifically versions through Rollout 524. No further sub‑versions are listed as affected; users should assume all releases up to and including that rollout are vulnerable.

The CVSS score of 5.3 categorizes the vulnerability as Medium. No EPSS score is available, but because the flaw requires only a crafted HTTP request, the risk of exploitation may be higher in organizations with exposed Webbox instances. The issue is not included in the CISA KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is remote, where an attacker directs a user to a malicious URL containing the encoded newline or colon characters to trigger the header injection.