The vulnerability in Tobit Laboratories AG TeamDavid's Webbox move archive functionality (!ArcEntryMove) arises from improper input validation of the 'pathname' parameter. This parameter can be set to arbitrary paths, including UNC paths pointing to network locations. The server processes these paths without validation, resulting in outbound SMB connection attempts to attacker-controlled servers. Authenticated attackers can exploit this to trigger server authentication to arbitrary SMB endpoints, potentially exposing NTLM authentication information such as NTLM hashes. If outbound connections on port 445 are permitted, attackers may conduct SMB relay or credential theft attacks. Exploitation is possible without authentication. The vulnerability affects TeamDavid through Rollout 524. No patch or remediation level has been provided by the vendor as of the publication date.

Successful exploitation allows unauthenticated attackers to cause the vulnerable server to initiate SMB connections to attacker-controlled endpoints. This can lead to exposure of NTLM authentication credentials, enabling SMB relay or credential theft attacks. The impact is medium severity given the potential credential exposure and the requirement that outbound SMB connections be permitted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict outbound SMB connections (port 445) from the server to untrusted networks to mitigate potential exploitation. Monitor for unusual SMB connection attempts originating from the server. No vendor advisory or patch information is currently available.