Executive Summary

CVE-2026-2752 is a vulnerability in Navtor NavBox that allows remote, unauthenticated attackers to send specially crafted requests to the /api/ais-data endpoint. This triggers an unhandled exception causing the server to return detailed .NET stack traces. These error messages expose internal class names, method calls, and third-party library references, which can help attackers understand the internal structure of the application.

Additionally, this vulnerability allows attackers to access exposed HTTP API endpoints without authentication, retrieving unencrypted JSON objects containing sensitive information such as environmental data, configuration parameters, operational telemetry, and service status.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information about the vessel’s internal network and maritime Industrial Control Systems/Operational Technology (ICS/OT) environment. Attackers gaining this insight may use it to plan further attacks or disrupt maritime cybersecurity.

The exposure of detailed internal application data and operational telemetry can compromise confidentiality, potentially leading to security breaches or operational disruptions.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending crafted HTTP requests to the /api/ais-data endpoint of the Navtor NavBox system and observing the server's response.

If the server returns verbose .NET stack traces containing internal class names, method calls, or third-party library references, it indicates the presence of the vulnerability.

A simple command to test this could be using curl to send a request and check the response for error stack traces.

• curl -v http://<navbox-ip-or-hostname>/api/ais-data

If the response contains detailed .NET exception stack traces or sensitive internal information, the system is vulnerable.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves updating the Navtor NavBox software to a patched version.

NAVTOR has addressed this vulnerability in NavBox version 4.16.2.4 and later, which include patches to prevent unauthenticated access to sensitive API endpoints.

Until the update can be applied, restrict network access to the NavBox system, especially blocking external or untrusted sources from accessing the /api/ais-data endpoint.

Implement network-level controls such as firewalls or access control lists (ACLs) to limit exposure.

Useful 0 Not Useful 0