CVE-2026-54218

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server (see vulnerability “Random File Read”), can potentially obtain affected users’ passwords. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

CVSS

No CVSS.

References

Link	Resource
https://chayns.net/77892-10814/tapp/763210?postId=11454
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/
https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Uso de vulnerabilidad de clave criptográfica codificada de forma rígida en Webbox de Tobit Laboratories AG TeamDavid. Para los usuarios creados localmente en David, las contraseñas se almacenan en varios archivos utilizando solo ofuscación. Cualquier usuario con acceso al sistema de archivos del servidor, o que de otro modo pueda extraer archivos del servidor (véase la vulnerabilidad ’Random File Read’), puede obtener potencialmente las contraseñas de los usuarios afectados. Este problema afecta a TeamDavid hasta el Rollout 524.

Information

Published : 2026-08-07 10:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-54218

Mitre link : CVE-2026-54218

CVE.ORG link : CVE-2026-54218

JSON object : View

Products Affected

No product.

CWE

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2026-54218", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54218", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T11:22:20.906417Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vulnerability@ncsc.ch", "affectedData": [{"vendor": "Tobit Laboratories AG", "modules": ["Webbox"], "product": "TeamDavid", "versions": [{"status": "affected", "version": "0", "lessThan": "Rollout 528", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-07T10:16:59.153", "references": [{"url": "https://chayns.net/77892-10814/tapp/763210?postId=11454", "source": "vulnerability@ncsc.ch"}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "source": "vulnerability@ncsc.ch"}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "vulnerability@ncsc.ch", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various \nfiles using only obfuscation. Any user with access to the server\u2019s file \nsystem, or who can otherwise extract files from the server (see \nvulnerability\u00a0\u201cRandom File Read\u201d), can potentially obtain affected \nusers\u2019 passwords.\u00a0This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."}, {"lang": "es", "value": "Uso de vulnerabilidad de clave criptogr\u00e1fica codificada de forma r\u00edgida en Webbox de Tobit Laboratories AG TeamDavid. Para los usuarios creados localmente en David, las contrase\u00f1as se almacenan en varios archivos utilizando solo ofuscaci\u00f3n. Cualquier usuario con acceso al sistema de archivos del servidor, o que de otro modo pueda extraer archivos del servidor (v\u00e9ase la vulnerabilidad \u2019Random File Read\u2019), puede obtener potencialmente las contrase\u00f1as de los usuarios afectados. Este problema afecta a TeamDavid hasta el Rollout 524."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "vulnerability@ncsc.ch"}