CVE-2026-54213: CWE-284 Improper Access Control in Tobit Laboratories AG TeamDavid
Tobit Laboratories AG TeamDavid's Webbox application contains an improper access control vulnerability where an unauthenticated attacker can access the /internalRestart endpoint to shut down the server completely. This results in a persistent denial of service requiring manual administrator intervention to recover. The vulnerability affects versions before Rollout 528, where the functionality is disabled by default, mitigating the issue.
AI Analysis
Technical Summary
The vulnerability in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated remote attackers to access a specific endpoint (/internalRestart) that shuts down the server instead of restarting it. This improper access control (CWE-284) leads to a persistent denial of service condition. The issue affects TeamDavid versions prior to Rollout 528. Starting with Rollout 528 (June 30, 2026), the vulnerable functionality is disabled by default, removing exposure to this attack vector.
Potential Impact
An unauthenticated remote attacker can cause a persistent denial of service by shutting down the TeamDavid web server via the exposed /internalRestart endpoint. Recovery requires manual administrator intervention to restart the service, potentially causing downtime and service disruption.
Mitigation Recommendations
Starting with Rollout 528 (June 30, 2026), the vulnerable functionality is disabled by default, effectively mitigating this issue. Users should upgrade to Rollout 528 or later to eliminate exposure. No patch links are provided, but upgrading to the fixed version is the recommended remediation.
CVE-2026-54213: CWE-284 Improper Access Control in Tobit Laboratories AG TeamDavid
Description
Tobit Laboratories AG TeamDavid's Webbox application contains an improper access control vulnerability where an unauthenticated attacker can access the /internalRestart endpoint to shut down the server completely. This results in a persistent denial of service requiring manual administrator intervention to recover. The vulnerability affects versions before Rollout 528, where the functionality is disabled by default, mitigating the issue.
CVSS v4.0
Score 9.2critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated remote attackers to access a specific endpoint (/internalRestart) that shuts down the server instead of restarting it. This improper access control (CWE-284) leads to a persistent denial of service condition. The issue affects TeamDavid versions prior to Rollout 528. Starting with Rollout 528 (June 30, 2026), the vulnerable functionality is disabled by default, removing exposure to this attack vector.
Potential Impact
An unauthenticated remote attacker can cause a persistent denial of service by shutting down the TeamDavid web server via the exposed /internalRestart endpoint. Recovery requires manual administrator intervention to restart the service, potentially causing downtime and service disruption.
Mitigation Recommendations
Starting with Rollout 528 (June 30, 2026), the vulnerable functionality is disabled by default, effectively mitigating this issue. Users should upgrade to Rollout 528 or later to eliminate exposure. No patch links are provided, but upgrading to the fixed version is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wrxj-2wgm-px6x
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-54213"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a75f70cbf8831d53984f579
Added to database: 08/07/2026, 15:17:32 UTC
Last enriched: 09/07/2026, 17:08:54 UTC
Last updated: 09/21/2026, 22:01:35 UTC
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.