Security vulnerabilities reported in Kaleris Navis N4 terminal Operating System
Take action: If you use Navis N4 Terminal Operating System, first check if it's isolated from the internet or requires internet connectivity. Then, prioritize updating to the latest patched version for your branch. If you can't update right away, isolate your N4 systems from the internet or disable the Ultra Light Client component on any internet-facing systems.
Learn More
Kaleris has patched multiple security vulnerabilities in its Navis N4 Terminal Operating System. Navis N4 is a software for management of port operations and maritime infrastructure like vessel berthing, cargo movement, yard planning, and gate processing.
Vulnerabilities summary
- CVE-2025-2566 (CVSS score 9.3) - Deserialization of Untrusted Data - the flaw is caused by unsafe Java deserialization in the Ultra Light Client (ULC) component. An unauthenticated attacker can craft malicious requests to execute arbitrary code on the server, potentially gaining the same privileges as the application server itself.
- CVE-2025-5087 (CVSS score 6.0) - Cleartext Transmission of Sensitive Information - this vulnerability allows attackers capable of observing network traffic between Ultra Light Clients and N4 servers to extract sensitive information, including plaintext credentials, due to insecure communication using zlib-compressed data over HTTP.
The vulnerabilities affect Navis N4 Terminal Operating System versions prior to 4.0.
Kaleris has released patches for these vulnerabilities and recommends users implement the following updated versions or later:
- Navis N4: Version 3.1.44+
- Navis N4: Version 3.2.26+
- Navis N4: Version 3.3.27+
- Navis N4: Version 3.4.25+
- Navis N4: Version 3.5.18+
- Navis N4: Version 3.6.14+
- Navis N4: Version 3.7.0+
- Navis N4: Version 3.8.0+
For organizations unable to immediately update, Kaleris advises isolating the N4 systems from the internet unless absolutely required. Organizations that must expose systems to the internet should disable the Ultra Light Client on exposed nodes by blocking specific URL patterns in load balancers or firewalls. Alternative secure access methods is to set up VPN connections, authenticated jump systems, or whitelisting external IP addresses as a last resort.
Kaleris has proactively sent security advisories to all customers running their software and established a dedicated contact point at security@kaleris.com for additional information.
