{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54211", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "state": "PUBLISHED", "assignerShortName": "NCSC.ch", "dateReserved": "2026-06-12T09:32:46.514Z", "datePublished": "2026-08-07T09:46:50.005Z", "dateUpdated": "2026-09-07T12:58:13.534Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-09-07T12:58:13.534Z"}, "title": "TeamDavid: Buffer Overflow in multiple form data parameters", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds write", "type": "CWE"}]}], "affected": [{"vendor": "Tobit Laboratories AG", "product": "TeamDavid", "modules": ["Webbox"], "versions": [{"status": "affected", "version": "0", "lessThan": "Rollout 528", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Tobit Laboratories AG TeamDavid's Webbox application\u2019s endpoint \u201c//serverClient_close.html\u201d is vulnerable to a\n buffer overflow vulnerability in multiple form data parameters. By \nsubmitting excessively long values in these parameters, an authenticated\n attacker can trigger a server crash, resulting in denial of service. \nDepending on the stack state or if a stack canary can be disclosed \nthrough another vulnerability, this buffer overflow could potentially be\n exploited for remote code execution, leading to full compromise of the \nserver.\u00a0This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Tobit Laboratories AG TeamDavid's Webbox application\u2019s endpoint \u201c//serverClient_close.html\u201d is vulnerable to a\n buffer overflow vulnerability in multiple form data parameters. By \nsubmitting excessively long values in these parameters, an authenticated\n attacker can trigger a server crash, resulting in denial of service. \nDepending on the stack state or if a stack canary can be disclosed \nthrough another vulnerability, this buffer overflow could potentially be\n exploited for remote code execution, leading to full compromise of the \nserver.&nbsp;<div><div><span>This issue affects TeamDavid before Rollout 528.</span></div><div><span>Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.</span></div></div>"}]}], "references": [{"url": "https://chayns.net/77892-10814/tapp/763210?postId=11454", "tags": ["release-notes"]}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.5, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "credits": [{"lang": "en", "value": "Dario Weiss of InfoGuard Labs", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T14:39:30.956429Z", "id": "CVE-2026-54211", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:39:36.097Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54211", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T14:39:30.956429Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:39:32.789Z"}}], "cna": {"title": "TeamDavid: Buffer Overflow in multiple form data parameters", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Dario Weiss of InfoGuard Labs"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Tobit Laboratories AG", "modules": ["Webbox"], "product": "TeamDavid", "versions": [{"status": "affected", "version": "0", "lessThan": "Rollout 528", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://chayns.net/77892-10814/tapp/763210?postId=11454", "tags": ["release-notes"]}, {"url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Tobit Laboratories AG TeamDavid's Webbox application\u2019s endpoint \u201c//serverClient_close.html\u201d is vulnerable to a\n buffer overflow vulnerability in multiple form data parameters. By \nsubmitting excessively long values in these parameters, an authenticated\n attacker can trigger a server crash, resulting in denial of service. \nDepending on the stack state or if a stack canary can be disclosed \nthrough another vulnerability, this buffer overflow could potentially be\n exploited for remote code execution, leading to full compromise of the \nserver.\u00a0This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.", "supportingMedia": [{"type": "text/html", "value": "Tobit Laboratories AG TeamDavid's Webbox application\u2019s endpoint \u201c//serverClient_close.html\u201d is vulnerable to a\n buffer overflow vulnerability in multiple form data parameters. By \nsubmitting excessively long values in these parameters, an authenticated\n attacker can trigger a server crash, resulting in denial of service. \nDepending on the stack state or if a stack canary can be disclosed \nthrough another vulnerability, this buffer overflow could potentially be\n exploited for remote code execution, leading to full compromise of the \nserver.&nbsp;<div><div><span>This issue affects TeamDavid before Rollout 528.</span></div><div><span>Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.</span></div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds write"}]}], "providerMetadata": {"orgId": "455daabc-a392-441d-aa46-37d35189897c", "shortName": "NCSC.ch", "dateUpdated": "2026-09-07T12:58:13.534Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54211", "state": "PUBLISHED", "dateUpdated": "2026-09-07T12:58:13.534Z", "dateReserved": "2026-06-12T09:32:46.514Z", "assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c", "datePublished": "2026-08-07T09:46:50.005Z", "assignerShortName": "NCSC.ch"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["Webbox"], "product": "TeamDavid", "vendor": "Tobit Laboratories AG", "versions": [{"lessThan": "Rollout 528", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "vulnerability@ncsc.ch"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tobit Laboratories AG TeamDavid's Webbox application\u2019s endpoint \u201c//serverClient_close.html\u201d is vulnerable to a\n buffer overflow vulnerability in multiple form data parameters. By \nsubmitting excessively long values in these parameters, an authenticated\n attacker can trigger a server crash, resulting in denial of service. \nDepending on the stack state or if a stack canary can be disclosed \nthrough another vulnerability, this buffer overflow could potentially be\n exploited for remote code execution, leading to full compromise of the \nserver.\u00a0This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."}], "id": "CVE-2026-54211", "lastModified": "2026-09-07T13:20:29.623", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.5, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vulnerability@ncsc.ch", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54211", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T14:39:30.956429Z", "version": "2.0.3"}}]}, "published": "2026-08-07T10:16:58.170", "references": [{"source": "vulnerability@ncsc.ch", "url": "https://chayns.net/77892-10814/tapp/763210?postId=11454"}, {"source": "vulnerability@ncsc.ch", "url": "https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/"}], "sourceIdentifier": "vulnerability@ncsc.ch", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "vulnerability@ncsc.ch", "type": "Secondary"}]}

{}