TeamDavid: Weak Cryptography and Insecure Password Storage
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8
exploitation probability
—
observed exploitation
nono source reports it
Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various
files using only obfuscation. Any user with access to the server’s file
system, or who can otherwise extract files from the server (see
vulnerability “Random File Read”), can potentially obtain affected
users’ passwords. This issue affects TeamDavid through Rollout 524.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Tobit Laboratories AG · TeamDavid