CVE-2026-54204 Overview
CVE-2026-54204 affects Tobit Laboratories AG TeamDavid's Webbox component. The search functionality accepts a pathnameroot parameter that can be set to Universal Naming Convention (UNC) paths pointing to attacker-controlled Server Message Block (SMB) endpoints. The server processes these paths without validation and initiates outbound authentication attempts. Unauthenticated attackers can coerce the server into leaking NTLM authentication material, enabling SMB relay and credential theft attacks. The vulnerability is classified under [CWE-20] Improper Input Validation.
Critical Impact
An unauthenticated remote attacker can force the TeamDavid Webbox server to authenticate to an arbitrary SMB endpoint, exposing NTLM hashes that can be relayed or cracked to compromise domain credentials.
Affected Products
- Tobit Laboratories AG TeamDavid (all versions through Rollout 524)
- TeamDavid Webbox component
- Deployments with outbound TCP/445 (SMB) permitted
Discovery Timeline
- 2026-08-07 - CVE-2026-54204 published to NVD
- 2026-08-07 - Last updated in NVD database
Technical Details for CVE-2026-54204
Vulnerability Analysis
The Webbox search endpoint exposes a pathnameroot parameter intended to scope search operations to a filesystem location. The server treats the value as a trusted path and passes it directly to filesystem APIs that resolve UNC syntax. When an attacker supplies a value such as \\attacker.example.com\share, the Windows host performs name resolution and opens an SMB session to the remote endpoint. During session setup, the operating system automatically negotiates authentication using the service account credentials, transmitting an NTLMv2 challenge-response over the wire.
Because the endpoint requires no authentication, any network-reachable attacker can trigger this behavior. A responder-style listener on the attacker's SMB server captures the NTLM material for offline cracking or immediate relay to another service such as LDAP or SMB signing-disabled hosts. The full technical write-up is available in the Infoguard CVE Analysis Post.
Root Cause
The root cause is missing input validation on the pathnameroot parameter. The application does not enforce a schema, drive-letter prefix, or allowlist that would prevent UNC paths from being resolved. It also does not restrict the identities used for outbound authentication.
Attack Vector
Exploitation requires only network access to the Webbox HTTP interface. An attacker sends a crafted search request with pathnameroot set to a UNC path referencing an attacker-controlled host. The Webbox server resolves the host and initiates an SMB session, at which point NTLM authentication material is captured by the attacker's listener.
No verified proof-of-concept code has been published. See the Infoguard research post for additional technical details.
Detection Methods for CVE-2026-54204
Indicators of Compromise
- Outbound TCP/445 connections originating from the TeamDavid Webbox server to unexpected external or internal hosts.
- HTTP requests to the Webbox search endpoint containing a pathnameroot parameter with a value beginning with \\ or //.
- Windows Security event ID 4648 (explicit credential logon) or NTLM authentication events sourced from the Webbox service account to unfamiliar destinations.
Detection Strategies
- Inspect web server access logs for query strings containing UNC-style path prefixes on the Webbox search endpoint.
- Deploy network sensors that alert on egress SMB traffic from application servers that should not initiate outbound SMB.
- Correlate NTLM authentication events with outbound SMB sessions to identify coerced authentication patterns.
Monitoring Recommendations
- Enable NTLM auditing on the Webbox host and forward events to a central log platform for review.
- Monitor for anomalous DNS resolution requests from the Webbox server that indicate attempts to resolve attacker-controlled hostnames.
- Track outbound firewall denies on port 445 originating from the application tier as a leading indicator of exploitation attempts.
How to Mitigate CVE-2026-54204
Immediate Actions Required
- Upgrade TeamDavid to a release later than Rollout 524 that includes the vendor fix, as documented in the Release Notes - David Tobit.
- Block outbound TCP/445 and TCP/139 from the Webbox server at the perimeter and internal firewalls.
- Restrict access to the Webbox management and search interfaces to authenticated, trusted networks.
Patch Information
Tobit addresses the issue in TeamDavid releases published after Rollout 524. Administrators should review the vendor Release Notes - David Tobit to confirm the fixed build and apply the update following standard change control.
Workarounds
- Enforce egress filtering that denies SMB and WebDAV traffic from the Webbox server to any destination outside the trusted management network.
- Configure the Windows host to enable SMB signing and disable NTLM where feasible, reducing the value of captured hashes.
- Run the Webbox service under a low-privilege account with no interactive logon rights and no privileged group membership to limit relay impact.
# Configuration example - block outbound SMB from the Webbox host
New-NetFirewallRule -DisplayName "Block Outbound SMB" -Direction Outbound `
-Protocol TCP -RemotePort 445,139 -Action Block -Profile Any
# Enable NTLM auditing to detect coerced authentication
Auditpol /set /subcategory:"Logon" /success:enable /failure:enable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
