This vulnerability involves the use of a hard-coded cryptographic key in TeamDavid's Webbox, leading to weak protection of locally created user passwords. Passwords are stored in various files using only obfuscation rather than secure encryption. If an attacker gains access to the server's file system or can extract files (e.g., via a related 'Random File Read' vulnerability), they can potentially recover user passwords. The issue affects TeamDavid versions through Rollout 524. There is no vendor advisory indicating a patch or fix at this time.

An attacker with access to the server file system or the ability to extract files can potentially obtain user passwords stored with weak obfuscation. This compromises user credential confidentiality and may lead to unauthorized access. The CVSS 4.0 score of 8.8 reflects high severity due to network attack vector, no privileges required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the server file system and monitor for unauthorized file extraction attempts to reduce risk.