The NavBox device allows unauthenticated HTTP GET requests on TCP port 8080, exposing internal network parameters, ECDIS and OT information, device identifiers, and service status logs. This missing authentication flaw (CWE‑306) lets a remote attacker learn detailed configuration and operational data that could be used for reconnaissance or to plan further attacks. The vulnerability is read‐only, so it does not grant code execution, but the sensitive data expose the device and network to significant risk.

All NavTor NavBox devices running impacted firmware are affected. No specific version is listed, so any device that has not applied the vendor’s fix or upgraded firmware is vulnerable.

The CVSS score of 7.5 indicates a high severity level for confidentiality and integrity. Although the EPSS score is below 1% and the vulnerability is not in the CISA KEV catalog, an attacker with network access to port 8080 can exploit the flaw remotely. The likelihood remains low, but the impact of disclosed configuration makes it a priority to mitigate.