NavBox’s /api/ais-data endpoint is vulnerable to an unhandled exception that returns verbose .NET stack traces when a remote attacker sends crafted requests. The resulting error messages reveal internal class names, method calls, and third‑party library references such as System.Data.SQLite, thereby exposing the application’s internal structure. This behavior corresponds to an information‑disclosure weakness (CWE‑209).

The affected product is Navtor NavBox; no specific affected versions are listed in the CVE payload.

The CVSS score of 5.3 places this vulnerability in the moderate severity range, while the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation is possible over the network by any host capable of issuing HTTP requests to the /api/ais-data endpoint; authentication is not required.