CVE-2026-2752 Information disclosure in NavBox
Remote unauthenticated attackers can trigger exceptions in Navtor NavBox to reveal verbose stack traces, exposing internal application structure and library details.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2752?
CVE-2026-2752 is a medium-severity vulnerability in Navtor NavBox, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandled exception, causing the server to return verbose .NET stack traces. These error messages expose internal class names, method calls, and third-party library references (e.g., System.Data.SQLite), which may assist attackers in mapping the application's internal structure.
Weakness: CWE-209
Which versions are affected by CVE-2026-2752?
It affects 1 product.
Products include Navtor Navbox Firmware.
How do I fix CVE-2026-2752?
No fix has been published for CVE-2026-2752 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-2752 being exploited?
There is no known exploitation of CVE-2026-2752 in the wild and no public exploit code.
Other vulnerabilities in Navtor NavBox
Sources
Also known as GHSA-cv33-x5rj-6f75.