Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve internal network parameters including ECDIS & OT Information, device identifiers, and service status logs.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
CVE-2026-2754 Unauthenticated Information Disclosure in Navtor NavBox HTTP API Endpoints https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2754
Post summary
A brief disclosure of CVE-2026-2754, describing unauthenticated information disclosure in Navtor NavBox HTTP API endpoints.
CVE-2026-2754 Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network … https://www.cve.org/CVERecord?id=CVE-2026-2754
Post summary
CVE-2026-2754 reveals that Navtor NavBox lacks authentication on its HTTP API endpoints, enabling unauthenticated attackers to access sensitive configuration and operational data.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | navtor | navbox | - | - | - |
| OS | navtor | navbox_firmware | - | - | - |