{"id":"CVE-2026-54218","state":"PUBLISHED","title":"TeamDavid: Weak Cryptography and Insecure Password Storage","description":"Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various \nfiles using only obfuscation. Any user with access to the server’s file \nsystem, or who can otherwise extract files from the server (see \nvulnerability “Random File Read”), can potentially obtain affected \nusers’ passwords. This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.","publishedAt":"2026-08-07T09:49:24.052Z","updatedAt":"2026-09-07T13:03:59.486Z","severity":{"score":8.8,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","source":"NCSC.ch"},"assigner":"NCSC.ch","products":["Tobit Laboratories AG TeamDavid"],"affected":[{"vendor":"Tobit Laboratories AG","product":"TeamDavid","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"Rollout 528","versionType":"custom"}],"modules":["Webbox"]}],"references":["https://chayns.net/77892-10814/tapp/763210?postId=11454","https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/"],"weaknesses":["CWE-321"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/54xxx/CVE-2026-54218.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-54218","state":"PUBLISHED","datePublished":"2026-08-07T09:49:24.052Z","dateUpdated":"2026-09-07T13:03:59.486Z","assignerShortName":"NCSC.ch","assignerOrgId":"455daabc-a392-441d-aa46-37d35189897c","dateReserved":"2026-06-12T09:32:46.515Z"},"containers":{"cna":{"title":"TeamDavid: Weak Cryptography and Insecure Password Storage","descriptions":[{"lang":"en","value":"Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various \nfiles using only obfuscation. Any user with access to the server’s file \nsystem, or who can otherwise extract files from the server (see \nvulnerability “Random File Read”), can potentially obtain affected \nusers’ passwords. This issue affects TeamDavid before Rollout 528.\n\nStarting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality."}],"affected":[{"vendor":"Tobit Laboratories AG","product":"TeamDavid","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"Rollout 528","versionType":"custom"}],"modules":["Webbox"]}],"references":[{"url":"https://chayns.net/77892-10814/tapp/763210?postId=11454","tags":["release-notes"]},{"url":"https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.8,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-321","lang":"en","description":"CWE-321 Use of hard-coded cryptographic key","type":"CWE"}]}],"providerMetadata":{"shortName":"NCSC.ch","orgId":"455daabc-a392-441d-aa46-37d35189897c","dateUpdated":"2026-09-07T13:03:59.486Z"},"credits":[{"lang":"en","value":"Lucas Dodgson of InfoGuard Labs","type":"finder"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-07T11:22:20.906417Z","id":"CVE-2026-54218","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-07T11:22:37.650Z"}}]}}}