Tobit Laboratories TeamDavid up to Rollout 524 File Upload buffer overflow

Summaryinfo

A vulnerability labeled as very critical has been found in Tobit Laboratories TeamDavid up to Rollout 524. Affected by this issue is some unknown functionality of the component File Upload. The manipulation results in buffer overflow. This vulnerability is known as CVE-2026-54210. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Tobit Laboratories TeamDavid up to Rollout 524. It has been classified as very critical. Affected is an unknown part of the component File Upload. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker can trigger a crash of the server, resulting in a denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid through Rollout 524.

The advisory is available at david.tobit.software. This vulnerability is traded as CVE-2026-54210 since 06/12/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/07/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Tobit Laboratories

Name

• TeamDavid

Version

• Rollout 524

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion