The vulnerability in Tobit Laboratories AG TeamDavid arises from improper input validation (CWE-20) of the 'pathnameroot' parameter in the Webbox search functionality. This parameter accepts UNC paths (e.g., \\Server\Share) without validation, causing the server to initiate outbound SMB connections to attacker-controlled endpoints. This behavior can lead to the exposure of NTLM authentication data such as hashes, enabling attacks like SMB relay or credential theft. Exploitation does not require authentication. The issue affects TeamDavid versions up to and including Rollout 524. No patch or official remediation has been disclosed as of the publication date.

An unauthenticated attacker can exploit this vulnerability to force the TeamDavid server to connect to arbitrary SMB servers controlled by the attacker. This can result in the leakage of NTLM authentication information, including hashes, which may be used in further attacks such as SMB relay or credential theft. The vulnerability requires that outbound connections to port 445 (SMB) are allowed from the server. The impact is high due to the potential for credential exposure and unauthorized access escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting outbound SMB (port 445) connections from the TeamDavid server to untrusted networks to mitigate exploitation risk. Monitor for unusual outbound SMB traffic originating from the server. Follow any future vendor advisories for official patches or mitigations.