CVE-2026-2753

7.5 highEPSS 0.5%

High (7.5) in navtor navbox firmware. EPSS 0.5% chance of exploitation in the next 30 days.

An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path input. Unauthenticated remote attackers can exploit this issue by submitting requests containing absolute filesystem paths. Successful exploitation allows the attacker to retrieve arbitrary files from the underlying filesystem, limited only by the privileges of the service process. This can lead to the exposure of sensitive configuration files and system information.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE: CWE-36
Published: 2026-03-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

navtor:navbox_firmware

References

https://cydome.io/vulnerability-advisory-cve-2026-2753-in-navtor-navbox-version-4-12-0-3
https://www.navtor.com/navtor-vendor-statement

Check your stack JSON