CVE-2026-54203 TeamDavid: Memory Leak leaking sensitive information
Unauthenticated attackers can read sensitive data, including passwords, via a memory leak in the Webbox component of TeamDavid.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54203?
CVE-2026-54203 is a critical vulnerability in Tobit Laboratories AG TeamDavid, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds with memory. By repeatedly requesting this endpoint, an attacker can access sensitive information, including user passwords. Exploitation does not require authentication. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
Weakness: CWE-200
Which versions are affected by CVE-2026-54203?
How do I fix CVE-2026-54203?
No fix has been published for CVE-2026-54203 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-54203 being exploited?
There is no known exploitation of CVE-2026-54203 in the wild and no public exploit code.
Sources
Also known as GHSA-v8q6-f954-39gq.