CVE-2026-54204
Received Received - Intake

UNC Path Handling Flaw in TeamDavid's Webbox Enables SMB Relay

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: Switzerland Government Common Vulnerability Program

Description
Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables unauthenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information (such as NTLM hashes). If outbound connections to port 445 (SMB) are permitted, attackers can use this to conduct SMB relay or credential theft attacks. Exploitation of the “pathnameroot” parameter is possible without authentication. This issue affects TeamDavid through Rollout 524.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-54204
EUVD
EUVD-2026-54436

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tobit_laboratories_ag teamdavid to 524 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows unauthenticated attackers to set a 'pathnameroot' parameter to UNC paths pointing to attacker-controlled SMB servers. The server processes these paths without validation, triggering outbound SMB connection attempts. This exposes NTLM authentication information like hashes, enabling potential SMB relay or credential theft attacks if outbound SMB traffic is permitted.

Detection Guidance

Monitor outbound SMB connections (port 445) from TeamDavid's Webbox server. Check logs for unusual UNC path requests in the 'pathnameroot' parameter. Use network traffic analysis tools like Wireshark to detect unauthorized SMB authentication attempts.

Impact Analysis

If exploited, attackers could steal NTLM hashes or credentials, leading to unauthorized access to systems or data. This could result in data breaches, lateral movement within networks, or further attacks leveraging stolen credentials. The impact depends on network configurations and whether outbound SMB traffic is allowed.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face fines, legal penalties, or reputational damage due to non-compliance if this flaw is exploited.

Mitigation Strategies

Disable or restrict outbound SMB connections from the TeamDavid server. Block port 445 at the firewall for all non-essential systems. Update TeamDavid to the latest Rollout version beyond 524 if available. Monitor for unauthorized UNC path usage in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54204. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart