View CSAF
1. EXECUTIVE SUMMARY

CVSS v4 9.3
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Kaleris
Equipment: Navis N4
Vulnerabilities: Deserialization of Untrusted Data, Cleartext Transmission of Sensitive Information

2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to remotely exploit the operating system, achieve remote code execution, or extract sensitive information.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following versions of Kaleris Navis N4, a terminal operating system, are affected:

Navis N4: Versions prior to 4.0

3.2 VULNERABILITY OVERVIEW
3.2.1 DESERIALIZATION OF UNTRUSTED DATA CWE-502
Kaleris NAVIS N4 ULC (Ultra Light Client) contains an unsafe Java deserialization vulnerability. An unauthenticated attacker can make specially crafted requests to execute arbitrary code on the server.
CVE-2025-2566 has been assigned to this vulnerability. A CVSS v3.1 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A CVSS v4 score has also been calculated for CVE-2025-2566. A base score of 9.3 has been calculated; the CVSS vector string is (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
3.2.2 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic between Ultra Light Clients and N4 servers can extract sensitive information, including plaintext credentials.
CVE-2025-5087 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
A CVSS v4 score has also been calculated for CVE-2025-5087. A base score of 6.0 has been calculated; the CVSS vector string is (AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N).
3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Transportation Systems
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER
Kaleris reported these vulnerabilities to CISA.
4. MITIGATIONS
Kaleris recommends users to implement the following versions or later:

Navis N4: Version 3.1.44+
Navis N4: Version 3.2.26+
Navis N4: Version 3.3.27+
Navis N4: Version 3.4.25+
Navis N4: Version 3.5.18+
Navis N4: Version 3.6.14+
Navis N4: Version 3.7.0+
Navis N4: Version 3.8.0+

If users are unable to update, Kaleris recommends following these mitigations:

If N4 does not need to be exposed to the internet, placing it behind a firewall.
If CAP needs to be exposed to the internet, disable the Ultra Light Client on the nodes being exposed. This can be done by blocking the Ultra Light Client URLs in the load balancer or firewall by blocking the following patterns: "url-pattern*.jnlp
https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-01