CVE-2026-54213 TeamDavid: Denial of Service via endpoint 'internalRestart'
Unauthenticated remote attackers can shut down the TeamDavid Webbox server via the internalRestart endpoint, causing persistent denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54213?
CVE-2026-54213 is a critical denial of service vulnerability in Tobit Laboratories AG TeamDavid, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be shut down when a specific endpoint (/internalRestart) is accessed. This endpoint is accessible to unauthenticated users over the public Internet. Instead of “restarting”, the server shuts completely down. As a result, a remote attacker can trigger a persistent denial of service by shutting down the web server without requiring authentication. Recovery requires manual administrator intervention to restart the service. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
Weakness: CWE-284
Which versions are affected by CVE-2026-54213?
How do I fix CVE-2026-54213?
No fix has been published for CVE-2026-54213 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-54213 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54213 exists.
Sources
Also known as GHSA-wrxj-2wgm-px6x.