The vulnerability in Tobit Laboratories AG TeamDavid's Webbox involves improper input validation (CWE-20) of the @@INCLUDE command that accepts UNC paths (e.g., \\Server\Share). The server processes these paths without validation, causing it to initiate outbound SMB connections to attacker-controlled endpoints. This can lead to the server authenticating to arbitrary SMB servers, potentially exposing NTLM hashes. If outbound SMB connections on port 445 are allowed, attackers may leverage this to conduct SMB relay or credential theft attacks. Notably, exploitation of the pathname parameter does not require authentication. The vulnerability affects TeamDavid through Rollout 524. There is no vendor advisory or patch information available at this time.

An attacker can cause the vulnerable server to initiate outbound SMB connections to attacker-controlled servers, potentially exposing NTLM authentication hashes. This can facilitate SMB relay or credential theft attacks if network conditions permit outbound SMB traffic. The vulnerability can be exploited without authentication, increasing the risk of unauthorized credential exposure. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting outbound SMB (port 445) connections from the server to prevent exploitation. Monitor for unusual outbound SMB traffic. No vendor advisory or official remediation instructions are currently provided.