CVE-2026-54205 Overview
CVE-2026-54205 affects Tobit Laboratories AG TeamDavid's Webbox component through Rollout 524. The vulnerability resides in the link storing functionality at //ServerClient_celink.htm, which accepts a pathname parameter without validating its contents. Attackers can supply Universal Naming Convention (UNC) paths pointing to attacker-controlled Server Message Block (SMB) servers. The server then initiates outbound authentication attempts to those endpoints, exposing NTLM authentication material. Exploitation of the pathname parameter is possible without authentication. The flaw maps to improper input validation [CWE-20].
Critical Impact
Unauthenticated attackers can coerce the TeamDavid server into authenticating to arbitrary SMB endpoints, enabling NTLM hash capture and SMB relay attacks.
Affected Products
- Tobit Laboratories AG TeamDavid (Webbox component)
- All versions through Rollout 524
- Deployments where outbound TCP port 445 is permitted
Discovery Timeline
- 2026-08-07 - CVE-2026-54205 published to NVD
- 2026-08-07 - Last updated in NVD database
Technical Details for CVE-2026-54205
Vulnerability Analysis
The TeamDavid Webbox exposes a link storage endpoint at //ServerClient_celink.htm that accepts a user-supplied pathname parameter. The server processes this value as a filesystem path without validating whether it references a local resource or a remote UNC location. When the parameter contains a UNC path such as \\attacker.example.com\share, the Windows host performs a file access request against the specified SMB server. This access triggers automatic NTLM authentication from the TeamDavid service account. The attacker's SMB listener captures the NTLMv1 or NTLMv2 challenge-response, which can be cracked offline or relayed to another service in real time. Because the vulnerable parameter is reachable without authentication, any network-adjacent attacker can trigger the coercion.
Root Cause
The root cause is missing input validation on the pathname parameter. The application does not restrict path syntax, reject UNC prefixes, or verify that the target resides on a local volume before dereferencing it.
Attack Vector
An attacker sends an HTTP request to the Webbox //ServerClient_celink.htm endpoint with pathname set to a UNC path pointing at an SMB listener under attacker control. The listener, such as Responder or impacket-ntlmrelayx, captures the resulting authentication exchange. Captured hashes can be cracked offline, or relayed to services that do not enforce SMB signing.
No verified proof-of-concept code is publicly available. Refer to the Infoguard CVE Analysis for additional technical context.
Detection Methods for CVE-2026-54205
Indicators of Compromise
- Outbound TCP connections from the TeamDavid host to external IP addresses on port 445 (SMB).
- HTTP requests targeting /ServerClient_celink.htm containing pathname values that begin with \\ or //.
- Unexpected NTLM authentication events originating from the TeamDavid service account to unknown destinations.
- Presence of external hostnames or IP literals inside stored link records within TeamDavid databases.
Detection Strategies
- Deploy web-server logging rules that flag any request to ServerClient_celink.htm where the pathname parameter matches a UNC pattern.
- Correlate web access logs with outbound SMB traffic using SIEM queries that join HTTP request timing with firewall connection logs.
- Alert on any new outbound port 445 flow originating from application servers that historically communicate only with internal file shares.
Monitoring Recommendations
- Continuously monitor egress firewall logs for TCP/445 traffic leaving the network perimeter.
- Track NTLM authentication events (Windows Event ID 4624 type 3) sourced from server accounts to unusual destinations.
- Baseline typical Webbox request patterns and alert on payloads containing backslash sequences or file scheme prefixes.
How to Mitigate CVE-2026-54205
Immediate Actions Required
- Block outbound TCP port 445 and port 139 at the perimeter firewall for hosts running TeamDavid.
- Restrict access to the Webbox //ServerClient_celink.htm endpoint to trusted internal networks using reverse-proxy or firewall rules.
- Audit stored link records for UNC entries pointing at external hosts and remove any suspicious values.
- Rotate credentials for service accounts that run the TeamDavid process if compromise is suspected.
Patch Information
Monitor the David Tobit Release Notes for fixed Rollout versions superseding Rollout 524. Apply the vendor update as soon as a corrected release becomes available.
Workarounds
- Enforce SMB signing and Extended Protection for Authentication (EPA) across the domain to blunt relay attacks.
- Configure the Windows host to deny outbound NTLM to remote servers using the Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers policy.
- Deploy a Web Application Firewall (WAF) rule that rejects HTTP requests containing UNC prefixes in the pathname parameter.
- Isolate the TeamDavid server in a dedicated network segment with strict egress filtering.
# Windows firewall rule: block outbound SMB from the TeamDavid host
New-NetFirewallRule -DisplayName "Block Outbound SMB" `
-Direction Outbound `
-Protocol TCP `
-RemotePort 445,139 `
-Action Block
# Group Policy setting to restrict outgoing NTLM
# Computer Configuration > Windows Settings > Security Settings >
# Local Policies > Security Options
# "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers" = Deny all
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
