Sensitive Data Exposure in Navtor NavBox by Navtor
CVE-2026-2754

7.5HIGH

Key Information:

Vendor

Navtor

Status
Navbox
Vendor
CVE Published:
6 March 2026

What is CVE-2026-2754?

Navtor NavBox allows unauthenticated remote access to sensitive configuration and operational data through its HTTP API endpoints. Attackers with network access can execute unauthorized HTTP GET requests, exposing critical internal parameters, including ECDIS & OT information, device identifiers, and service status logs. This vulnerability poses serious risks to data security and network integrity.

Affected Version(s)

NavBox 4.12.0.3

NavBox 4.16.2.4

References

https://cydome.io/vulnerability-advisory-cve-2026-2754-in...
technical-description
https://www.navtor.com/navtor-vendor-statement
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cydome Security Ltd
.