CVE-2026-54207: TeamDavid Webbox SSRF Vulnerability

CVE-2026-54207 Overview

CVE-2026-54207 affects Tobit Laboratories AG TeamDavid's Webbox component. The move archive functionality !ArcEntryMove accepts arbitrary path values without validation. Attackers can supply Universal Naming Convention (UNC) paths pointing to attacker-controlled Server Message Block (SMB) servers. The server then initiates outbound authentication attempts, exposing NTLM authentication material.

The advisory notes that exploitation of the pathname parameter is possible without authentication. This affects TeamDavid through Rollout 524. The vulnerability is classified as improper input validation [CWE-20].

Critical Impact
Attackers can coerce the TeamDavid Webbox server to authenticate against arbitrary SMB endpoints, enabling NTLM hash capture and SMB relay attacks against internal infrastructure.

Affected Products

Tobit Laboratories AG TeamDavid (all versions through Rollout 524)
TeamDavid Webbox component with !ArcEntryMove functionality
Deployments permitting outbound SMB (TCP port 445) traffic

Discovery Timeline

2026-08-07 - CVE-2026-54207 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-54207

Vulnerability Analysis

The TeamDavid Webbox exposes a move archive operation identified as !ArcEntryMove. This function accepts a destination path from the client request. The server passes the supplied path directly to Windows file APIs without validating whether the target references a local filesystem location or a remote UNC share.

When an attacker submits a UNC path such as \\attacker-host\share, Windows attempts to resolve the SMB endpoint. The operating system automatically negotiates authentication using the service account context of the Webbox process. This exposes the NT LAN Manager (NTLM) challenge-response exchange to the attacker's SMB listener.

Captured NTLMv2 hashes can be cracked offline or relayed in real time against other network services that accept NTLM authentication. The advisory states that the pathname parameter path can be reached without authentication, broadening the attack surface beyond authenticated users.

Root Cause

The root cause is missing validation of user-controlled path input in the !ArcEntryMove handler. The application does not enforce that destination paths reference the local filesystem or a pre-approved storage location. Windows path parsing treats strings prefixed with \\ as remote SMB references, so any unvalidated pass-through to file APIs creates an outbound authentication primitive.

Attack Vector

The attack occurs over the network. An attacker operates an SMB responder on an internet-reachable host or on the internal network. The attacker sends a crafted Webbox request setting the destination path parameter to a UNC value pointing at the responder. The Webbox server initiates an SMB session and offers NTLM credentials for the account running the service. The attacker captures the hash or relays the authentication to a target such as LDAP, SMB file shares, or Active Directory Certificate Services.

Refer to the Infoguard CVE Analysis Post for the disclosure details.

Detection Methods for CVE-2026-54207

Indicators of Compromise

Outbound TCP connections from the TeamDavid Webbox host to external IP addresses on port 445 (SMB)
Windows Security Event ID 4648 entries showing explicit credential use from the Webbox service account to unexpected hosts
HTTP requests to the Webbox endpoint containing !ArcEntryMove with a pathname value beginning with \\
SMB responder tool signatures (Responder, Impacket ntlmrelayx, smbserver.py) observed in network captures involving the Webbox host

Detection Strategies

Alert on any egress SMB traffic originating from the TeamDavid server, which should not initiate arbitrary outbound SMB sessions
Inspect Webbox access logs for !ArcEntryMove requests where path parameters contain UNC prefixes or non-local drive references
Correlate authentication events for the Webbox service account against a baseline of expected destinations

Monitoring Recommendations

Log all Webbox API requests and retain path parameter values for retrospective analysis
Monitor NTLM authentication attempts from the Webbox host using Windows Event ID 4624 with logon type 3
Deploy network sensors to identify SMB negotiation traffic leaving trusted network segments

How to Mitigate CVE-2026-54207

Immediate Actions Required

Block outbound TCP port 445 and port 139 from the TeamDavid Webbox server at the perimeter and internal firewalls
Upgrade TeamDavid to a release beyond Rollout 524 once Tobit publishes a fix per the David Tobit Release Notes
Restrict access to the Webbox endpoint to authenticated users only where deployment allows, given the advisory notes unauthenticated reachability of pathname
Enforce SMB signing and Extended Protection for Authentication (EPA) on domain services to reduce relay success

Patch Information

Tobit Laboratories AG tracks fixes through its release notes portal. Administrators should consult the David Tobit Release Notes for the Rollout version that remediates CVE-2026-54207 and apply it across all TeamDavid Webbox instances.

Workarounds

Configure host-based firewall rules on the Webbox server to deny outbound SMB traffic to any destination outside a defined allowlist
Run the Webbox service under a low-privilege local account that has no domain membership, limiting the value of any captured NTLM material
Disable NTLM outbound authentication for the Webbox service account via Group Policy Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers
Segment the Webbox host into a network zone that cannot reach domain controllers or file servers on SMB ports

bash

# Windows firewall rule to block outbound SMB from the Webbox host
New-NetFirewallRule -DisplayName "Block Outbound SMB (CVE-2026-54207)" `
  -Direction Outbound `
  -Protocol TCP `
  -RemotePort 445,139 `
  -Action Block `
  -Profile Any