The vulnerability in TeamDavid's Webbox move archive functionality (!ArcEntryMove) stems from improper input validation of the 'pathname' parameter, which accepts arbitrary paths including UNC paths (e.g., \\Server\Share). The server processes these without validation, resulting in outbound SMB connection attempts to attacker-controlled endpoints. This behavior can be exploited by unauthenticated attackers to trigger server authentication to arbitrary SMB servers, potentially exposing NTLM hashes and enabling SMB relay or credential theft attacks. The issue affects versions prior to Rollout 528, where the functionality is disabled by default to mitigate the risk.

Exploitation allows unauthenticated attackers to cause the server to authenticate to attacker-controlled SMB servers, potentially exposing NTLM authentication hashes. If outbound SMB connections on port 445 are permitted, attackers can leverage this to conduct SMB relay or credential theft attacks, compromising authentication credentials. This can lead to unauthorized access or lateral movement within a network.

Starting with Rollout 528 (June 30, 2026), the vulnerable functionality is disabled by default, effectively mitigating the issue. Users should upgrade to Rollout 528 or later to ensure this protection. No additional action is required if running Rollout 528 or newer. For versions prior to Rollout 528, restrict outbound SMB connections to untrusted networks and consider disabling the move archive functionality if possible until an upgrade is applied.