CVE-2025-2566
Deserialization of Untrusted Data in Kaleris Navis N4
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jun 24, 2025
- Updated
- Jun 24, 2025
- Reserved
- Mar 20, 2025
Description
Kaleris NAVIS N4 ULC (Ultra Light Client) contains an unsafe Java deserialization vulnerability. An unauthenticated attacker can make specially crafted requests to execute arbitrary code on the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | icscert |
Weaknesses
- CWE-502 Deserialization of Untrusted Data
Affected Products
| Product | Versions |
|---|---|
Navis N4Kaleris |
|
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-01government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.