CVE-2026-54204 Tobit Laboratories AG CVE debrief

Who should care

Administrators of Tobit Laboratories AG TeamDavid, cybersecurity teams responsible for monitoring SMB connections, organizations concerned with protecting NTLM authentication information, and operators of affected systems should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

The Tobit Laboratories AG TeamDavid Webbox search functionality accepts a 'pathnameroot' parameter that can be set to network locations using UNC paths. The server processes these paths without validation, resulting in outbound connection attempts to attacker-controlled SMB servers. This enables unauthenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information. The vulnerability affects TeamDavid through Rollout 524 and can be exploited without authentication if outbound connections to port 445 are permitted.

Defensive priority

CVE-2026-54204 is rated HIGH with a CVSS score of 7.7; unauthenticated attackers can exploit this vulnerability to conduct SMB relay or credential theft attacks if outbound connections to port 445 are permitted.

Recommended defensive actions

• Verify and restrict outbound SMB connections to only necessary servers
• Implement monitoring for unusual SMB connection attempts
• Apply vendor remediation for TeamDavid Rollout 524 or later
• Conduct regular inventory checks for affected systems
• Consider compensating controls for NTLM authentication information protection
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-54204 vulnerability affects Tobit Laboratories AG TeamDavid through Rollout 524; details are based on NVD and CVE Program records, with limited additional source metadata available. The vulnerability allows unauthenticated attackers to trigger the server to authenticate to arbitrary SMB endpoints, potentially exposing NTLM authentication information. Evidence is limited, and defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.