CVE-2026-2754
Last modified
CVE-2026-2754 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve internal network parameters including ECDIS & OT Information, device identifiers, and service status logs.. EPSS estimates a 0.51% chance of exploitation in the next 30 days.
Description
Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve internal network parameters including ECDIS & OT Information, device identifiers, and service status logs.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Navtor | Navbox Firmware | >= 4.12.0.3, < 4.16.2.4 |
References
- https://www.navtor.com/navtor-vendor-statementVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-2754?
How severe is CVE-2026-2754?
How do I fix CVE-2026-2754?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-2753An Absolute Path Traversal vulnerability exists in Navtor Na…7.5
- CVE-2026-27530Rejected reason: Not used
- CVE-2026-27531Rejected reason: Not used
- CVE-2026-27532Rejected reason: Not used
- CVE-2026-27533Rejected reason: Not used
- CVE-2026-27534Rejected reason: Not used
- CVE-2026-27540Unrestricted Upload of File with Dangerous Type vulnerabilit…9
- CVE-2026-27541Incorrect Privilege Assignment vulnerability in Josh Kohlbac…7.2
- CVE-2026-27542Incorrect Privilege Assignment vulnerability in Rymera Web C…9.8
- CVE-2026-27545OpenClaw versions prior to 2026.2.26 contain an approval byp…4.7
- CVE-2026-2756A security vulnerability has been detected in OmniPEMF NeoRh…5
- CVE-2026-27566OpenClaw versions prior to 2026.2.22 contain an allowlist by…8.8
Are you affected by CVE-2026-2754?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST