The Webbox of TeamDavid by Tobit Laboratories AG improperly constructs redirect URLs by appending user input directly to the redirect target in HTTP 302 responses. This allows attackers to exploit URL-encoded characters (e.g., %2e) to manipulate the portion of the URL following the top-level domain, enabling redirection to malicious domains with similar TLDs. Furthermore, the use of URL-encoded line feeds permits injection of arbitrary HTTP response headers. The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) and affects TeamDavid through Rollout 524. The CVSS 4.0 base score is 5.3, indicating medium severity. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation can lead to users being redirected to malicious websites that may be used for phishing or other malicious activities. The injection of arbitrary HTTP response headers could potentially facilitate further attacks such as HTTP response splitting or cache poisoning. However, there is no indication of privilege escalation or direct code execution. The vulnerability requires user interaction (clicking a crafted URL) and has low complexity for an attacker to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should exercise caution with URLs involving TeamDavid Webbox redirects. Avoid clicking suspicious links and consider implementing web application firewall (WAF) rules to detect and block suspicious redirect patterns if possible. Monitor vendor communications for updates on patches or official mitigations.