CVE-2026-2754
Last modified
CVE-2026-2754 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve internal network parameters including ECDIS & OT Information, device identifiers, and service status logs.. EPSS estimates a 0.51% chance of exploitation in the next 30 days.
Description
Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve internal network parameters including ECDIS & OT Information, device identifiers, and service status logs.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Navtor | Navbox Firmware | >= 4.12.0.3, < 4.16.2.4 |
References
- https://www.navtor.com/navtor-vendor-statementVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-2754?
How severe is CVE-2026-2754?
How do I fix CVE-2026-2754?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-27534Rejected reason: Not used
- CVE-2026-27535Subscriber Broken Access Control in Solace Extra <= 1.6.0 ve…7.1
- CVE-2026-27536Unauthenticated Cross Site Scripting (XSS) in MailChimp Subs…7.1
- CVE-2026-27537Unauthenticated Cross Site Scripting (XSS) in Popup by Supsy…6.5
- CVE-2026-27538Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 v…7.5
- CVE-2026-27539Unauthenticated Cross Site Scripting (XSS) in Welcart e-Comm…7.1
- CVE-2026-27540Unrestricted Upload of File with Dangerous Type vulnerabilit…9
- CVE-2026-27541Incorrect Privilege Assignment vulnerability in Josh Kohlbac…7.2
- CVE-2026-27542Incorrect Privilege Assignment vulnerability in Rymera Web C…9.8
- CVE-2026-27543Unauthenticated Privilege Escalation in MStore API <= 4.20.0…8.1
- CVE-2026-27544Unauthenticated Remote Code Execution (RCE) in QA Analytics …10
- CVE-2026-27545OpenClaw versions prior to 2026.2.26 contain an approval byp…4.7
Are you affected by CVE-2026-2754?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST