The vulnerability in Tobit Laboratories AG TeamDavid's Webbox involves improper input validation (CWE-20) of the @@INCLUDE command parameter, which accepts UNC network paths (e.g., \\Server\Share). The server processes these paths without validation, causing it to initiate outbound SMB connections to attacker-controlled endpoints. This behavior can be abused by authenticated attackers to force the server to authenticate to arbitrary SMB servers, potentially exposing NTLM authentication information such as NTLM hashes. If outbound connections to SMB port 445 are allowed, attackers may leverage this for SMB relay or credential theft attacks. Additionally, exploitation of the pathname parameter does not require authentication. The vulnerability affects versions through Rollout 524. No patch or remediation level has been published.

An attacker can cause the TeamDavid server to make outbound SMB connections to attacker-controlled servers, potentially exposing NTLM authentication credentials. This can facilitate SMB relay or credential theft attacks if network conditions permit outbound SMB traffic on port 445. The vulnerability can be exploited without authentication via the pathname parameter, increasing the attack surface. The impact is medium severity due to the potential credential exposure and the requirement for network conditions that allow outbound SMB connections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict outbound SMB connections (port 445) from the TeamDavid server to untrusted networks to reduce risk. Monitor network traffic for unexpected SMB connection attempts. No official fix or temporary workaround has been published by the vendor at this time.