The vulnerability in Tobit Laboratories AG TeamDavid involves improper input validation (CWE-20) of the 'pathnameroot' parameter in the Webbox search functionality. This parameter can be set to UNC network paths, which the server processes without validation, resulting in outbound SMB connection attempts to attacker-controlled servers. Such behavior enables unauthenticated attackers to trigger NTLM authentication attempts to arbitrary SMB endpoints, potentially exposing NTLM hashes. This can facilitate SMB relay or credential theft attacks if port 445 outbound connections are permitted. The vulnerability affects versions of TeamDavid through Rollout 524. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can exploit this vulnerability to cause the TeamDavid server to initiate outbound SMB connections to attacker-controlled servers, potentially exposing NTLM authentication credentials. This exposure can lead to SMB relay or credential theft attacks, compromising authentication security. The vulnerability requires that outbound connections to port 445 are allowed for full exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict outbound SMB (port 445) connections from the TeamDavid server to untrusted networks to mitigate exploitation risk.