← Back

CVE-2026-2752

nvd nist
Published: Mar 6, 2026Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 3.9 / Impact: 1.4
Source: 56a186b1-7f5e-4314-ba38-38d5499fccfd (Secondary)

Description

Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandled exception, causing the server to return verbose .NET stack traces. These error messages expose internal class names, method calls, and third-party library references (e.g., System.Data.SQLite), which may assist attackers in mapping the application's internal structure.

Affected (1)

Navtor
1 product
Navbox Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Navbox Firmware
From 4.12.0.3 to 4.16.2.4
Running on/withPlatform Versions
Navtor
Navbox
All versions

Related CWEs

CWE-209
Generation of Error Message Containing Sensitive Information
The product generates an error message that includes sensitive information about its environment, users, or associated data.

References (2)

Source: 56a186b1-7f5e-4314-ba38-38d5499fccfd
Third Party Advisory
Source: 56a186b1-7f5e-4314-ba38-38d5499fccfd
Vendor Advisory

Timeline

No history available yet.