VulnerabilityAnalyzed

CVE-2026-2752

Navtor NavBox allows information disclosure via the /api/ais-data endpoint.

MEDIUM 5.3EPSS 0.26%

Does this matter?

Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.

Description

Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandled exception, causing the server to return verbose .NET stack traces. These error messages expose internal class names, method calls, and third-party library references (e.g., System.Data.SQLite), which may assist attackers in mapping the application's internal structure.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.26% probability · 18th percentile
CISA KEV: Not listed
Weakness: CWE-209
Affected: navtor/navbox firmware
Source: 56a186b1-7f5e-4314-ba38-38d5499fccfd

References

https://cydome.io/vulnerability-advisory-cve-2026-2752-in-navtor-navbox-version-4-12-0-3Third Party Advisory
https://www.navtor.com/navtor-vendor-statementVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.