The vulnerability in TeamDavid's Webbox application involves an out-of-bounds write (CWE-787) triggered by multiple form data parameters at the “//serverClient_close.html” endpoint. Excessively long values cause a buffer overflow, leading to a denial of service via server crash. Exploitation potential extends to remote code execution if stack canaries can be bypassed or disclosed through other vulnerabilities. This issue affects all versions prior to Rollout 528, which disables the vulnerable functionality by default as of June 30, 2026.

An authenticated attacker can cause a denial of service by crashing the server through buffer overflow. Additionally, if combined with other vulnerabilities that reveal stack canaries, the buffer overflow could be exploited for remote code execution, potentially resulting in full server compromise.

Starting with Rollout 528 (June 30, 2026), the vulnerable functionality is disabled by default, mitigating exposure to this vulnerability. Users should upgrade to Rollout 528 or later to ensure the vulnerability is no longer exposed. No other patches or fixes are currently documented.