CVE-2026-54203: critical vulnerability in Tobit Laboratories AG TeamDavid
TeamDavid: Memory Leak leaking sensitive information
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.2epss 0.6%
Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds
with memory. By repeatedly
requesting this endpoint, an attacker can access sensitive
information, including user passwords. Exploitation does not require
authentication. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Affected products
Tobit Laboratories AG · TeamDavidRelated CVEs — Tobit Laboratories AG TeamDavid
In the same product, most dangerous first.
CVE-2026-54213CRITICALTeamDavid: Denial of Service via endpoint 'internalRestart'EPSS 0.7%CVE-2026-54212CRITICALTeamDavid: Buffer Overflow in JSON-parsingEPSS 0.7%CVE-2026-54210CRITICALTeamDavid: Buffer Overflow in file names of file upload functionalitiesEPSS 0.7%CVE-2026-54211CRITICALTeamDavid: Buffer Overflow in multiple form data parametersEPSS 0.6%CVE-2026-54204HIGHTeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionalityEPSS 0.6%CVE-2026-54201MEDIUMTeamDavid: Missing AuthorizationEPSS 0.6%