CVE-2026-54209

{
  "id": "CVE-2026-54209",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T10:16:57.887",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by \nincluding the string \"(editini)\" in the file path, writing the new \npassword to the specified \"Archive.ini\" file. However, the application \ndoes not verify that the provided path actually refers to an \n\"Archive.ini\" file. If an attacker specifies a different file with \nexcessive size, a buffer overflow occurs. This vulnerability allows an \nunauthenticated attacker to crash the server, resulting in denial of \nservice. This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."
    },
    {
      "lang": "es",
      "value": "La aplicación Webbox de TeamDavid de Tobit Laboratories AG gestiona los cambios de contraseña utilizando una función que se activa al incluir la cadena ’(editini)’ en la ruta del archivo, escribiendo la nueva contraseña en el archivo ’Archive.ini’ especificado. Sin embargo, la aplicación no verifica que la ruta proporcionada se refiera realmente a un archivo ’Archive.ini’. Si un atacante especifica un archivo diferente con un tamaño excesivo, se produce un desbordamiento de búfer. Esta vulnerabilidad permite a un atacante no autenticado bloquear el servidor, lo que resulta en una denegación de servicio. Este problema afecta a TeamDavid hasta el Rollout 524."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Tobit Laboratories AG",
          "product": "TeamDavid",
          "defaultStatus": "unaffected",
          "modules": [
            "Webbox"
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "Rollout 528",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.9,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "HIGH",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T14:41:05.833002Z",
          "id": "CVE-2026-54209",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://chayns.net/77892-10814/tapp/763210?postId=11454",
      "source": "[email protected]"
    },
    {
      "url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/",
      "source": "[email protected]"
    }
  ]
}