Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to HTTP header injection through the
“cType” URL parameter, which allows arbitrary modification of the
Content-Type header in HTTP responses. Because the parameter does not
properly restrict control characters such as URL-encoded newlines
(“%0a”) or colons, attackers can inject additional headers including
extra Location headers into the server’s response. This results e.g. in
an open redirect vulnerability. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
CISA SSVCTrack at low or medium mission impact; Attend at high (mission-essential systems).
No fix is confirmed yet. Restrict network exposure of the affected system or apply the vendor's mitigation within your standard update timelines at low or medium mission impact and sooner than that at high, and watch the vendor's advisory for the fix.
Exploitation public PoC (CISA Vulnrichment) · Automatable yes (CISA Vulnrichment) · Technical impact partial (CISA Vulnrichment). Mission impact is CISA's Mission & Well-being decision point, and only you can judge it: high means the affected system is essential to your organisation's mission, or its compromise could cause irreversible harm to people. CISA's decision table