QSearchQSearch

CVE-2026-2754

7.5 HIGH

Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints

Published: 2026-03-06 · Last updated: 2026-06-05

Severity and scoring

CVSS
7.5 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
CWE-306

Affected products

VendorProduct
navtornavbox_firmware

Description

Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve internal network parameters including ECDIS & OT Information, device identifiers, and service status logs.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-2753 — An Absolute Path Traversal vulnerability exists in Navtor NavBox (7.5 HIGH)

Same CWE

  • CVE-2026-46612 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (8.8 HIGH)
  • CVE-2026-20253 — In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthen... (9.8 CRITICAL)
  • CVE-2026-45567 — Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers (8.3 HIGH)
  • CVE-2026-9045 — During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise... (7.8 HIGH)
  • CVE-2026-8335 — A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT"...