Is CVE-2026-2754 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2754 being exploited in the wild.

How severe is CVE-2026-2754?

High severity, with a CVSS score of 7.5, published 6 March 2026.

Which products and versions are affected?

NAVTOR NavBox 4.12.0.3 up to (excluding) 4.16.2.4.

Is there a fix for CVE-2026-2754?

A patch was published on 2025-11: Version 4.16.2.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2754 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-2754?

Check whether you run NAVTOR NavBox or NAVTOR Navbox Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2754: Navtor NavBox missing authentication in HTTP API

CVE-2026-2754 · Severity: high · CVSS 7.5 · Published 2026-03-06

Navtor NavBox, a maritime gateway used for distributing digital charts and navigational data, contains a security flaw that allows unauthorized access to sensitive information. An attacker with network access to the device can retrieve internal configuration details, operational logs, and maritime system identifiers without needing a password. This exposure could allow an adversary to map out shipboard networks or gain insights into vessel operations.

Technologies: NAVTOR NavBox, NAVTOR Navbox Firmware. Vendors: NAVTOR.

Quick answers

Is CVE-2026-2754 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2754 being exploited in the wild.
How severe is CVE-2026-2754?: High severity, with a CVSS score of 7.5, published 6 March 2026.
Which products and versions are affected?: NAVTOR NavBox 4.12.0.3 up to (excluding) 4.16.2.4.
Is there a fix for CVE-2026-2754?: A patch was published on 2025-11: Version 4.16.2.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2754 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-2754?: Check whether you run NAVTOR NavBox or NAVTOR Navbox Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability (CWE-306) exists in the HTTP API of Navtor NavBox. The flaw is located on TCP port 8080, where several endpoints fail to verify user identity before granting access to sensitive data. By sending unauthenticated HTTP GET requests, a remote attacker can extract internal network parameters, Electronic Chart Display and Information System (ECDIS) data, Operational Technology (OT) information, and service logs. Additionally, certain requests may trigger unhandled exceptions that disclose verbose stack traces, further revealing internal application architecture. The vulnerability is addressed in version 4.16.2.4.

Affected products

Navtor NavBox 4.12.0.3 up to (excluding) 4.16.2.4

Timeline

2025-11: patched: Version 4.16.2.4 released
2026-03-06: disclosed: Initial NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.