Mitigation Strategies

Immediate mitigation steps include restricting network access to the Navtor NavBox device, especially blocking unauthenticated access to TCP port 8080.

Upgrading the NavBox software to version 4.16.2.4 or later is recommended, as this version addresses the vulnerability by implementing proper authentication and fixing the information disclosure issue.

Additionally, monitor network traffic for unauthorized HTTP GET requests to port 8080 and consider implementing firewall rules to limit access to trusted hosts only.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-2754 is an information disclosure vulnerability in Navtor NavBox devices. It occurs because the HTTP API endpoints on TCP port 8080 lack authentication, allowing unauthenticated remote attackers with network access to retrieve sensitive configuration and operational data. This includes internal network parameters, device identifiers, ECDIS & OT information, and service status logs.

Additionally, in NavBox version 4.12.0.3, attackers can trigger an unhandled exception that discloses a verbose stack trace revealing internal application details, which could aid further attacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the exposure of sensitive internal data without requiring any authentication, which compromises confidentiality. Attackers can gain access to network parameters, device identifiers, and operational logs, potentially enabling further targeted attacks or unauthorized network reconnaissance.

While it does not impact integrity or availability, the disclosure of sensitive information can undermine the security posture of affected systems.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of Navtor NavBox devices exposing HTTP API endpoints on TCP port 8080 without authentication.

You can use network scanning tools to identify devices with open TCP port 8080 and then attempt HTTP GET requests to these endpoints to see if sensitive configuration and operational data are disclosed.

• Use nmap to scan for open port 8080: nmap -p 8080 <target-ip>
• Use curl or wget to send an HTTP GET request to the device on port 8080: curl http://<target-ip>:8080/
• Check the response for sensitive information such as ECDIS & OT Information, device identifiers, or service status logs.

Useful 0 Not Useful 0