PT-2026-23716 · Navtor · Navtor Navbox

Published 2026-03-06 · Updated 2026-03-06 · CVE-2026-2752

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Navtor NavBox (affected versions not specified)

Description A remote, unauthenticated attacker can send crafted requests to the /api/ais-data endpoint, triggering an unhandled exception. This causes the server to return verbose .NET stack traces, exposing internal class names, method calls, and third-party library references such as System.Data.SQLite. This information may assist attackers in mapping the application's internal structure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2026-2752

Affected Products

Navtor Navbox

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-2752 · Security Note
• https://navtor.com/navtor-vendor-statement · Vendor Advisory
• https://cydome.io/vulnerability-advisory-cve-2026-2752-in-navtor-navbox-version-4-12-0-3 · Note
• https://twitter.com/CVEnew/status/2029975494750531821 · Twitter Post