What is the CVSS score of CVE-2026-2753?

CVE-2026-2753 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Navbox Firmware are affected by CVE-2026-2753?

Navtor NavBox contains a critical path traversal vulnerability that could allow attackers to access unauthorized files and directories on affected systems, potentially exposing sensitive data and…

How to fix or mitigate CVE-2026-2753?

Within 24 hours: Inventory all NavBox deployments and assess exposure (internal vs. internet-facing). Within 7 days: Implement network segmentation and WAF rules to restrict malicious path traversal patterns; disable NavBox HTTP service if not business-critical. Within 30 days: Establish continuous monitoring for exploitation attempts; develop a patch deployment plan upon vendor release; conduct file access audit to detect unauthorized access.

Navbox Firmware CVE-2026-2753

HIGH

Absolute Path Traversal (CWE-36)

2026-03-06 56a186b1-7f5e-4314-ba38-38d5499fccfd

Path Traversal Navbox Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 15:16 nvd

HIGH 7.5

DescriptionCVE.org

An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path input. Unauthenticated remote attackers can exploit this issue by submitting requests containing absolute filesystem paths. Successful exploitation allows the attacker to retrieve arbitrary files from the underlying filesystem, limited only by the privileges of the service process. This can lead to the exposure of sensitive configuration files and system information.

AnalysisAI

Navtor NavBox exposes an unauthenticated path traversal vulnerability in its HTTP service that allows remote attackers to read arbitrary files from the server by submitting requests with absolute filesystem paths. Successful exploitation enables unauthorized disclosure of sensitive configuration files and system information, limited only by the service process privileges. No patch is currently available.

Technical ContextAI

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.