This vulnerability involves the use of a hard-coded cryptographic key in TeamDavid's Webbox, leading to weak protection of locally created user passwords stored in files with only obfuscation. Any user or attacker with file system access or the ability to extract files from the server can potentially obtain these passwords. The vulnerability affects TeamDavid versions prior to Rollout 528. From Rollout 528 onward, the affected functionality is disabled by default, reducing the risk of exploitation.

The vulnerability allows unauthorized parties with access to the server's file system or file extraction capabilities to obtain user passwords that are insufficiently protected due to the use of a hard-coded cryptographic key and weak obfuscation. This compromises user credential confidentiality and could lead to unauthorized access to user accounts.

Upgrade to TeamDavid Rollout 528 or later, where the vulnerable functionality is disabled by default, effectively mitigating the exposure. Since the vulnerability is addressed by disabling the affected functionality starting with Rollout 528, users should apply this update to remediate the issue.