CVE-2026-54203: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in Tobit Laboratories AG TeamDavid
CVE-2026-54203 is a critical vulnerability in Tobit Laboratories AG TeamDavid's Webbox that allows unauthorized actors to read sensitive information via a memory leak. The vulnerability is triggered by accessing the URL '/.well-known/mta-sts.', which causes the application to respond with memory contents including user passwords. Exploitation does not require authentication. This issue affects versions before Rollout 528. Starting with Rollout 528 (June 30, 2026), the vulnerable functionality is disabled by default, mitigating the exposure.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-54203) in TeamDavid's Webbox is a memory leak that exposes sensitive information such as user passwords to unauthorized actors. The flaw is exploitable without authentication by repeatedly requesting the '/.well-known/mta-sts.' endpoint, which returns memory data. The vulnerability affects TeamDavid versions prior to Rollout 528. From Rollout 528 onwards, the affected functionality is disabled by default, preventing exposure through this vector.
Potential Impact
An attacker can access sensitive information including user passwords without any authentication by exploiting the memory leak at the specified endpoint. This can lead to unauthorized disclosure of confidential data, posing a critical security risk.
Mitigation Recommendations
Starting with Rollout 528 (June 30, 2026), the vulnerable functionality is disabled by default, effectively mitigating the issue. Users should upgrade to Rollout 528 or later to ensure the vulnerability is not exposed. No other patch or fix is currently documented.
CVE-2026-54203: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in Tobit Laboratories AG TeamDavid
Description
CVE-2026-54203 is a critical vulnerability in Tobit Laboratories AG TeamDavid's Webbox that allows unauthorized actors to read sensitive information via a memory leak. The vulnerability is triggered by accessing the URL '/.well-known/mta-sts.', which causes the application to respond with memory contents including user passwords. Exploitation does not require authentication. This issue affects versions before Rollout 528. Starting with Rollout 528 (June 30, 2026), the vulnerable functionality is disabled by default, mitigating the exposure.
CVSS v4.0
Score 9.2critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-54203) in TeamDavid's Webbox is a memory leak that exposes sensitive information such as user passwords to unauthorized actors. The flaw is exploitable without authentication by repeatedly requesting the '/.well-known/mta-sts.' endpoint, which returns memory data. The vulnerability affects TeamDavid versions prior to Rollout 528. From Rollout 528 onwards, the affected functionality is disabled by default, preventing exposure through this vector.
Potential Impact
An attacker can access sensitive information including user passwords without any authentication by exploiting the memory leak at the specified endpoint. This can lead to unauthorized disclosure of confidential data, posing a critical security risk.
Mitigation Recommendations
Starting with Rollout 528 (June 30, 2026), the vulnerable functionality is disabled by default, effectively mitigating the issue. Users should upgrade to Rollout 528 or later to ensure the vulnerability is not exposed. No other patch or fix is currently documented.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-v8q6-f954-39gq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-54203"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a75f70dbf8831d53984f772
Added to database: 08/07/2026, 15:17:33 UTC
Last enriched: 09/07/2026, 17:09:54 UTC
Last updated: 09/22/2026, 01:56:05 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.