CVE-2026-54206: TeamDavid Webbox SSRF Vulnerability

CVE-2026-54206 Overview

CVE-2026-54206 affects Tobit Laboratories AG TeamDavid's Webbox messaging functionality, which handles outbound email, fax, and SMS delivery. The @@INCLUDE command accepts Universal Naming Convention (UNC) paths without validation. An attacker can supply a UNC path pointing to an attacker-controlled Server Message Block (SMB) share. The server then initiates an outbound SMB connection and authenticates to the remote endpoint, exposing NTLM authentication material. Attackers can leverage this behavior for SMB relay or NTLM hash capture attacks. Exploitation through the pathname parameter does not require authentication. The issue affects TeamDavid through Rollout 524 and is categorized under [CWE-20] Improper Input Validation.

Critical Impact
Unauthenticated attackers can coerce the TeamDavid server into leaking NTLM credentials to arbitrary SMB endpoints, enabling relay attacks and credential theft.

Affected Products

Tobit Laboratories AG TeamDavid (through Rollout 524)
TeamDavid Webbox messaging component (email, fax, SMS delivery)
Deployments permitting outbound TCP/445 (SMB) traffic

Discovery Timeline

2026-08-07 - CVE-2026-54206 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-54206

Vulnerability Analysis

The vulnerability resides in the Webbox subsystem responsible for outbound message delivery. TeamDavid supports an @@INCLUDE directive that references external content to embed in outgoing communications. The parser accepts arbitrary UNC paths, such as \\Server\Share\file, in the pathname parameter. Windows treats UNC references as remote SMB resources and initiates authenticated SMB sessions using the service account of the TeamDavid process. This authentication exchange transmits NTLM challenge-response data to the remote endpoint. An attacker controlling that endpoint can capture the hash for offline cracking or relay it to another service, such as LDAP or SMB signing-disabled hosts, to gain unauthorized access.

Root Cause

The root cause is missing input validation on the pathname parameter processed by the @@INCLUDE handler. The application does not restrict path types to local, canonicalized filesystem locations. It does not reject network paths, block UNC syntax, or apply an allowlist of trusted directories. Because the pathname parameter is reachable without authentication, any network-adjacent attacker can inject a malicious UNC value.

Attack Vector

Attack traffic originates over the network against the TeamDavid Webbox interface. The attacker submits a crafted request that sets the @@INCLUDE value to a UNC path targeting an attacker-operated SMB listener, for example a Responder or Impacket ntlmrelayx instance. Upon parsing, the server resolves the UNC path and Windows completes an NTLM authentication handshake with the attacker's host. The captured hash can be cracked offline or relayed in real time. Additional technical context is available in the Infoguard CVE Analysis.

Detection Methods for CVE-2026-54206

Indicators of Compromise

Outbound SMB (TCP/445) or NetBIOS (TCP/139) connections originating from the TeamDavid server to untrusted or external IP addresses.
Webbox request logs containing @@INCLUDE directives with values beginning with \\ or referencing non-local hosts.
Windows Security Event ID 4648 (explicit credential logon) or 4624 logon events from the TeamDavid service account against unexpected remote hosts.

Detection Strategies

Inspect HTTP request bodies to the Webbox endpoint for the string @@INCLUDE combined with UNC-style paths (\\ prefix).
Correlate application-layer requests with subsequent outbound SMB connections from the same host process within a short time window.
Alert on any outbound SMB traffic from mail or messaging gateways to non-corporate networks, since these services should rarely initiate SMB sessions to external hosts.

Monitoring Recommendations

Enable NTLM auditing (Audit NTLM authentication in this domain) and forward events to your Security Information and Event Management (SIEM) platform for review.
Deploy egress firewall logging for TCP/445 and TCP/139 to identify credential exfiltration attempts in real time.
Baseline normal Webbox traffic patterns and flag anomalous pathname parameter values that reference network locations.

How to Mitigate CVE-2026-54206

Immediate Actions Required

Block outbound SMB (TCP/445) and NetBIOS (TCP/139) traffic from the TeamDavid server at the perimeter and host firewalls.
Restrict access to the Webbox interface to trusted internal networks and require authentication where possible.
Audit recent Webbox request logs for @@INCLUDE directives containing UNC paths and rotate the service account credentials if suspicious activity is found.

Patch Information

Tobit tracks fixes in the David Tobit Release Notes. Administrators should upgrade beyond Rollout 524 to any subsequent release that addresses this input validation issue. Verify the fix version against the vendor advisory before deploying.

Workarounds

Enforce SMB signing and Extended Protection for Authentication (EPA) across the domain to blunt NTLM relay attacks.
Disable NTLM outbound authentication from the TeamDavid server using the Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers Group Policy setting.
Place the TeamDavid server in a network segment with strict egress filtering that permits only required destinations and protocols.

bash

# Example Windows Group Policy setting to block outbound NTLM
# Computer Configuration > Windows Settings > Security Settings >
#   Local Policies > Security Options
# Policy: Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
# Value: Deny all

# Example egress firewall rule (Windows Defender Firewall)
New-NetFirewallRule -DisplayName "Block Outbound SMB" \
  -Direction Outbound \
  -Protocol TCP \
  -RemotePort 445,139 \
  -Action Block \
  -Profile Any