Kaleris NAVIS N4 ULC Java Deserialization RCE (CVE-2025-2566)
CVE-2025-2566 Published on June 24, 2025
Deserialization of Untrusted Data in Kaleris Navis N4
Kaleris NAVIS N4 ULC (Ultra Light Client) contains an unsafe Java deserialization vulnerability. An unauthenticated attacker can make specially crafted requests to execute arbitrary code on the server.
Vulnerability Analysis
CVE-2025-2566 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2025-2566 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
Affected Versions
Kaleris Navis N4:- Before 4.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.