CVE-2026-2754

High

Published: 06 March 2026

Published

06 March 2026

Modified

10 March 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0004 10.7th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2754 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Cydome (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-11 Device Lock

addresses: CWE-306

Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.

AC-14 Permitted Actions Without Identification or Authentication

addresses: CWE-306

Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.

AC-19 Access Control for Mobile Devices

addresses: CWE-306

Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.

AC-25 Reference Monitor

addresses: CWE-306

Guarantees critical functions are protected by mandatory invocation of the access control mechanism.

AU-14 Session Audit

addresses: CWE-306

Auditing sessions makes it possible to detect access to critical functions without required authentication.

CA-2 Control Assessments

addresses: CWE-306

The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.

CA-4 Security Certification

addresses: CWE-306

Certification assesses that critical functions have required authentication controls in place.

CM-7 Least Functionality

addresses: CWE-306

Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1082 System Information Discovery Discovery

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

attack.mitre.org →

T1016 System Network Configuration Discovery Discovery

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

attack.mitre.org →

Why these techniques?

Missing auth on public HTTP API (port 8080) directly enables T1190 for initial remote access; retrieved config/OT/network data directly facilitates T1005 (local system data), T1082 (system info), and T1016 (network config discovery).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve internal network parameters…

including ECDIS & OT Information, device identifiers, and service status logs.

Deeper analysisAI

CVE-2026-2754 is a missing authentication vulnerability (CWE-306) in Navtor NavBox version 4.12.0.3, where HTTP API endpoints on TCP port 8080 lack proper authentication controls. This exposure allows access to sensitive configuration and operational data, including internal network parameters, ECDIS and OT information, device identifiers, and service status logs. Published on 2026-03-06, the vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting its high confidentiality impact with network-wide attack complexity.

An unauthenticated remote attacker with network access to the affected device can exploit this vulnerability by sending HTTP GET requests to the exposed API endpoints on port 8080. Successful exploitation enables retrieval of the sensitive data without requiring privileges, user interaction, or scope changes, potentially compromising operational technology environments in maritime settings.

Mitigation details are outlined in advisories from Cydome at https://cydome.io/vulnerability-advisory-cve-2026-2754-in-navtor-navbox-version-4-12-0-3 and Navtor's vendor statement at https://www.navtor.com/navtor-vendor-statement. Security practitioners should consult these resources for patching instructions, workarounds, and affected version confirmations.