CVE-2026-54218 PUBLISHED

TeamDavid: Weak Cryptography and Insecure Password Storage

Assigner: NCSC.ch
Reserved: 12.06.2026 Published: 07.08.2026 Updated: 07.08.2026

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server (see vulnerability “Random File Read”), can potentially obtain affected users’ passwords. This issue affects TeamDavid through Rollout 524.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.8

Product Status

Vendor Tobit Laboratories AG
Product TeamDavid
Versions Default: unaffected
  • affected from 0 to Rollout 524 (incl.)

Credits

  • Lucas Dodgson of InfoGuard Labs finder

References

Problem Types

  • CWE-321 Use of hard-coded cryptographic key CWE