Kaleris Navis N4 Terminal Operating System

Summary

Vulnerabilities 2

• Critical 9.3
  CVE-2025-2566

  Deserialization of Untrusted Data in Kaleris Navis N4

  Kaleris NAVIS N4 ULC (Ultra Light Client) contains an unsafe Java deserialization vulnerability. An unauthenticated attacker can make specially crafted requests to execute arbitrary code on the server.

  Kaleris Navis N4
  Jun 24, 2025
• Medium 6.0
  CVE-2025-5087

  Cleartext Transmission of Sensitive Information in Kaleris Navis N4

  Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic between Ultra Light Clients and N4 servers can extract sensitive information, including plaintext credenti…

  Kaleris Navis N4
  Jun 24, 2025

Revision history

1. 2025-06-24 #1

   Initial Publication

References

• ICSA Advisory ICSA-25-175-01 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-01
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B