Full Report
Researchers from Cydome have disclosed three vulnerabilities affecting NAVTOR NavBox version 4.12.0.3, a maritime connectivity device widely used... The post Cydome flags NAVTOR NavBox path traversal and authentication flaws exposing vessel data, networks to cyber risk appeared first on Industrial Cyber.
Analysis Summary
# Vulnerability: Multiple Flaws in NAVTOR NavBox Maritime Connectivity Device
## CVE Details
- **CVE ID:** CVE-2026-2752, CVE-2026-2753, CVE-2026-2754
- **CVSS Score:** 7.5 (High) for CVE-2026-2752 and CVE-2026-2753
- **CWE:**
- CWE-306 (Missing Authentication for Critical Function)
- CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Absolute Path Traversal)
- CWE-209 (Generation of Error Message Containing Sensitive Information)
## Affected Systems
- **Products:** NAVTOR NavBox (Maritime connectivity and navigation data distribution device)
- **Versions:** Version 4.12.0.3 and earlier builds.
- **Configurations:** Systems exposed to untrusted networks or with accessible HTTP services/API endpoints.
## Vulnerability Description
Researchers from Cydome identified three distinct security flaws:
1. **Missing Authentication (CVE-2026-2752):** Internal API endpoints lack proper authentication controls, allowing unauthenticated attackers to query and retrieve unencrypted JSON data containing vessel telemetry, configuration parameters, and service statuses.
2. **Path Traversal (CVE-2026-2753):** An absolute path traversal flaw in the device’s HTTP service allows attackers to use crafted requests to bypass directory restrictions and read arbitrary files from the underlying host operating system.
3. **Information Disclosure (CVE-2026-2754):** The application generates verbose stack traces during unhandled exceptions. This leak provides attackers with internal details such as class names, method calls, and third-party library references.
## Exploitation
- **Status:** Vulnerabilities were responsibly disclosed; no reported exploitation in the wild at the time of the report.
- **Complexity:** Low (Targeting unauthenticated APIs and path traversal typically requires minimal technical barrier).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Access to sensitive real-time telemetry, OT network information, ECDIS IP addresses, and OS-level configuration files).
- **Integrity:** Medium (Exposure of system data facilitates further exploitation/manipulation of the environment).
- **Availability:** Low (While primarily an information disclosure risk, access to system files can be a precursor to DoS attacks).
## Remediation
### Patches
- NAVTOR has released patches to address these vulnerabilities. Users should upgrade to **Version 4.16.2.4** or later.
### Workarounds
- Protect the device behind a firewall or VPN.
- Restrict network access to the device’s HTTP/API endpoints to authorized internal segments only.
- Ensure the device is not directly exposed to the internet, especially when using LEO (Low Earth Orbit) broadband services.
## Detection
- **Indicators of Compromise:** Unusual HTTP GET requests containing directory traversal sequences (e.g., `../` or absolute paths) in web server logs.
- **Detection methods and tools:**
- Monitor API logs for unauthorized queries to environmental and telemetry endpoints.
- Inspect application logs for excessive unhandled exceptions or stack trace generation.
- Use OT-specialized vulnerability scanners to identify legacy versions of NavBox.
## References
- **Vendor Advisory:** NAVTOR (Direct communication to customers).
- **Cydome Research:** hxxps[://]cydome[.]io/cydome-discovered-three-vulnerabilities-in-navtor-navbox-version-4-12-0-3/
- **Industrial Cyber Report:** hxxps[://]industrialcyber[.]co/threats-attacks/cydome-flags-navtor-navbox-path-traversal-and-authentication-flaws-exposing-vessel-data-networks-to-cyber-risk/