CVE-2026-2754

CVE-2026-2754 affects Navtor NavBox devices, which expose sensitive configuration and operational data through unauthenticated HTTP API endpoints on TCP port 8080. An unauthenticated remote attacker can exploit this vulnerability to retrieve critical internal network parameters, including ECDIS and OT information, device identifiers, and service status logs. With a CVSS score of 7.5 (High), this vulnerability is easily exploitable over the network with low attack complexity, leading to high confidentiality impact without requiring user interaction. There is currently no evidence of active exploitation, nor are there public exploit modules available in Metasploit, Nuclei, or ExploitDB, though it has garnered minimal community discussion.