CVE-2026-2754

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve internal network parameters including ECDIS & OT Information, device identifiers, and service status logs.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Mar 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-275409.0Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-whole CVE-2026-275417.2Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This CVE-2026-275429.8Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture CVE-2026-275438.1Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.CVE-2026-2754410.0Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.CVE-2026-275454.7OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attackers to execute comma CVE-2026-275469.8An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accoun CVE-2026-275478.8A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using vali CVE-2026-275488.8A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user CVE-2026-275498.8A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint usi CVE-2026-275508.8A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials CVE-2026-275518.8A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user cr