This vulnerability (CVE-2026-54203) involves a memory leak in Tobit Laboratories AG TeamDavid's Webbox component. When an attacker accesses the endpoint '/.well-known/mta-sts.', the application responds with memory contents that may include sensitive information such as user passwords. The flaw does not require any authentication or user interaction to exploit. It affects TeamDavid through Rollout 524. The CVSS 4.0 score is 9.2 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality and security capabilities. No vendor advisory or patch information is currently available.

An attacker can remotely and unauthenticatedly access sensitive information, including user passwords, by exploiting a memory leak via a specific URL endpoint. This exposure can lead to significant confidentiality breaches and compromise user accounts or system integrity. The vulnerability is rated critical with a CVSS score of 9.2, indicating severe impact on confidentiality and security controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible and monitor for unusual access patterns targeting '/.well-known/mta-sts.'.