CVE-2026-54213: CWE-284 Improper Access Control in Tobit Laboratories AG TeamDavid
Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart) is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of “restarting”, the server shuts completely down. As a result, a remote attacker can trigger a persistent denial of service by shutting down the web server without requiring authentication. Recovery requires manual administrator intervention to restart the service. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
AI Analysis
Technical Summary
CVE-2026-54213 describes an improper access control vulnerability (CWE-284) in Tobit Laboratories AG TeamDavid's Webbox application. The application exposes a publicly accessible endpoint (/internalRestart) that allows unauthenticated users to shut down the server completely rather than restarting it. This flaw enables remote attackers to trigger a persistent denial of service condition by shutting down the web server without any authentication or user interaction. The vulnerability affects TeamDavid through Rollout 524. There is no information about available patches or fixes, and recovery requires manual restart by an administrator.
Potential Impact
An unauthenticated remote attacker can cause a persistent denial of service by shutting down the TeamDavid web server via the exposed /internalRestart endpoint. This disrupts service availability until manual administrator intervention restarts the server. The vulnerability does not require any privileges or user interaction, making it highly impactful for service continuity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint by network controls such as firewall rules or VPN access to prevent unauthenticated external access. Monitor for attempts to access the /internalRestart endpoint and prepare for manual recovery procedures.
CVE-2026-54213: CWE-284 Improper Access Control in Tobit Laboratories AG TeamDavid
Description
Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart) is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of “restarting”, the server shuts completely down. As a result, a remote attacker can trigger a persistent denial of service by shutting down the web server without requiring authentication. Recovery requires manual administrator intervention to restart the service. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
CVSS v4.0
Score 9.2critical
Affected software
Tobit Laboratories AG
TeamDavid
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-54213 describes an improper access control vulnerability (CWE-284) in Tobit Laboratories AG TeamDavid's Webbox application. The application exposes a publicly accessible endpoint (/internalRestart) that allows unauthenticated users to shut down the server completely rather than restarting it. This flaw enables remote attackers to trigger a persistent denial of service condition by shutting down the web server without any authentication or user interaction. The vulnerability affects TeamDavid through Rollout 524. There is no information about available patches or fixes, and recovery requires manual restart by an administrator.
Potential Impact
An unauthenticated remote attacker can cause a persistent denial of service by shutting down the TeamDavid web server via the exposed /internalRestart endpoint. This disrupts service availability until manual administrator intervention restarts the server. The vulnerability does not require any privileges or user interaction, making it highly impactful for service continuity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint by network controls such as firewall rules or VPN access to prevent unauthenticated external access. Monitor for attempts to access the /internalRestart endpoint and prepare for manual recovery procedures.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- NCSC.ch
- Date Reserved
- 2026-06-12T09:32:46.514Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a75af81bf8831d53921d1df
Added to database: 08/07/2026, 10:12:17 UTC
Last enriched: 08/14/2026, 16:22:17 UTC
Last updated: 09/21/2026, 22:01:35 UTC
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.