Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

TeamDavid Webbox: Unauthenticated Server Shutdown

CVE-2026-54213 · published 28 days ago
Summary

An attacker can shut down the TeamDavid Webbox server without a password, causing it to be unavailable. This is a concern because it can lead to lost productivity and revenue. To protect against this, administrators should ensure that access to the /internalRestart endpoint is restricted to authenticated users only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
tobit laboratories ag teamdavid <= Rollout 524
Original advisory text
TeamDavid: Denial of Service via endpoint 'internalRestart'
Tobit Laboratories AG TeamDavid's Webbox application exposes a functionality that allows the server to be
shut down when a specific endpoint (/internalRestart) is accessed. This
endpoint is accessible to unauthenticated users over the public
Internet. Instead of “restarting”, the server shuts completely down. As a
result, a remote attacker can trigger a persistent denial of service by
shutting down the web server without requiring authentication. Recovery
requires manual administrator intervention to restart the service. This issue affects TeamDavid through Rollout 524.
References
Severity
9.2 Critical
CVSS 4.0: 9.2 (NVD)
Exploitation
EPSS <1%
Type
CWE-284Improper Access Control
Timeline
Published7 Aug 2026
Updated3 Sep 2026
First seen7 Aug 2026
Sources
CVE-2026-54213 · NVD
CVE-2026-54213 · MITRE
Monitor software like this
Free during beta