The vulnerability in Tobit Laboratories AG TeamDavid's Webbox move archive functionality (!ArcEntryMove) arises from improper input validation of the 'pathname' parameter. This parameter accepts arbitrary paths, including UNC network paths (e.g., \\Server\Share), without validation. Consequently, the server attempts outbound SMB connections to these attacker-controlled endpoints. Authenticated attackers can exploit this to cause the server to authenticate to arbitrary SMB servers, potentially exposing NTLM hashes. Exploitation is possible without authentication. This vulnerability affects TeamDavid through Rollout 524 and is tracked as CVE-2026-54207 with a CVSS 4.0 base score of 6.3 (medium severity). No patch or remediation level is currently documented.

Successful exploitation can lead to the server initiating outbound SMB connections to attacker-controlled servers, exposing NTLM authentication information such as NTLM hashes. This can facilitate SMB relay attacks or credential theft if outbound connections to port 445 are permitted. The vulnerability does not require user interaction or privileges to exploit and can be triggered unauthenticated via the pathname parameter.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict outbound SMB (port 445) connections from the affected server to untrusted networks to reduce risk. Monitor network policies to prevent unauthorized SMB traffic. Avoid exposing the affected service to untrusted networks where possible.