What is the CVSS score of CVE-2026-2752?

CVE-2026-2752 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Navbox Firmware are affected by CVE-2026-2752?

Organizations using Navtor NavBox should be aware of moderate risk from CVE-2026-2752 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-2752?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Navbox Firmware CVE-2026-2752

MEDIUM

Error Message Information Leak (CWE-209)

2026-03-06 56a186b1-7f5e-4314-ba38-38d5499fccfd

Information Disclosure Navbox Firmware Navtor

5.3

CVSS 3.1 · Vendor: 56a186b1-7f5e-4314-ba38-38d5499fccfd

Severity by source

Vendor (56a186b1-7f5e-4314-ba38-38d5499fccfd) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (56a186b1-7f5e-4314-ba38-38d5499fccfd) · only source for this CVE.

CVSS VectorVendor: 56a186b1-7f5e-4314-ba38-38d5499fccfd

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 15:16 nvd

MEDIUM 5.3

DescriptionCVE.org

Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandled exception, causing the server to return verbose .NET stack traces. These error messages expose internal class names, method calls, and third-party library references (e.g., System.Data.SQLite), which may assist attackers in mapping the application's internal structure.

AnalysisAI

The /api/ais-data endpoint in Navtor NavBox leaks sensitive information through unhandled exception error messages, allowing unauthenticated remote attackers to obtain verbose .NET stack traces containing internal class names, method calls, and library dependencies. This information disclosure (CWE-209) enables attackers to map the application's internal structure and identify potential attack vectors. No patch is currently available for this medium-severity vulnerability affecting .NET implementations.

Technical ContextAI

Classified as CWE-209 (Error Message Information Leak). Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandled exception, causing the server to return verbose .NET stack traces. These error messages expose internal class names, method calls, and third-party library references (e.g., System.Data.SQLite), which may assist attackers in mapping the application's internal structure.