CVE-2026-2753
Published: 06 March 2026
Summary
CVE-2026-2753 is a high-severity Absolute Path Traversal (CWE-36) vulnerability in Navtor Navbox Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-14 (Public Access Protections).
Deeper analysis
CVE-2026-2753 is an absolute path traversal vulnerability (CWE-36) affecting Navtor NavBox, specifically version 4.12.0.3. The application exposes an HTTP service that fails to properly sanitize user-supplied path input, allowing attackers to traverse the filesystem using absolute paths. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for authentication, privileges, or user interaction.
Unauthenticated remote attackers can exploit this vulnerability by submitting crafted HTTP requests containing absolute filesystem paths. Successful exploitation enables retrieval of arbitrary files from the underlying filesystem, constrained only by the privileges of the service process. This can result in the exposure of sensitive configuration files and system information.
Mitigation details are available in advisories from Cydome at https://cydome.io/vulnerability-advisory-cve-2026-2753-in-navtor-navbox-version-4-12-0-3 and the Navtor vendor statement at https://www.navtor.com/navtor-vendor-statement.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10038
Vulnerability details
An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path input. Unauthenticated remote attackers can exploit this issue by submitting requests containing absolute filesystem paths. Successful exploitation allows…
more
the attacker to retrieve arbitrary files from the underlying filesystem, limited only by the privileges of the service process. This can lead to the exposure of sensitive configuration files and system information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The path traversal in the unauthenticated public HTTP service directly enables remote file retrieval from the local filesystem (T1005) via exploitation of a public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring validation and sanitization of user-supplied path inputs in HTTP requests to prevent absolute path traversal.
Enforces logical access controls to restrict filesystem access to authorized paths only, blocking unauthorized retrieval of arbitrary files.
Implements protections on the publicly accessible HTTP service to prevent unauthorized disclosure of sensitive configuration files and system information.