CVE-2025-5087: Kaleris NAVIS N4 ULC Information Disclosure

CVE-2025-5087 Overview

CVE-2025-5087 affects the Kaleris NAVIS N4 Ultra Light Client (ULC), a terminal operating system component used in maritime and port logistics environments. The client transmits data using zlib compression over plaintext HTTP rather than an encrypted transport. Attackers positioned on the network path between Ultra Light Clients and N4 servers can decompress captured traffic and recover sensitive information, including plaintext credentials. The weakness is categorized under CWE-319: Cleartext Transmission of Sensitive Information.

Critical Impact
Network-adjacent attackers can intercept ULC traffic, decompress the zlib payloads, and harvest plaintext credentials used to authenticate to N4 terminal operating system servers.

Affected Products

Kaleris NAVIS N4 Terminal Operating System
NAVIS N4 Ultra Light Client (ULC)
Deployments using HTTP transport between ULC and N4 servers

Discovery Timeline

2025-06-24 - CVE-2025-5087 published to the National Vulnerability Database
2025-06-24 - CISA ICS Advisory ICSA-25-175-01 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5087

Vulnerability Analysis

The NAVIS N4 Ultra Light Client communicates with backend N4 servers by serializing application data, compressing it with zlib, and transporting the result over HTTP. Compression is not encryption. Any observer on the network path can capture the raw HTTP bodies and pass them through a standard zlib decompressor to recover the original request and response contents.

Because the ULC protocol carries authentication material inside these payloads, credentials submitted at login and subsequent session data traverse the network in a recoverable form. An attacker who obtains a set of valid credentials can then authenticate to the N4 terminal operating system as the impersonated user and interact with cargo, vessel, and yard operations.

Root Cause

The root cause is the absence of transport-layer encryption between the ULC and N4 server components. The design relies on zlib for bandwidth efficiency and treats the compressed representation as an opaque wire format. It provides no confidentiality, no integrity protection, and no server authentication. This matches CWE-319, cleartext transmission of sensitive information.

Attack Vector

Exploitation requires network visibility into ULC-to-server traffic. Suitable positions include shared Layer 2 segments, port operator VPN concentrators, misconfigured wireless networks used by terminal staff, span ports, or upstream ISP infrastructure serving unmanaged remote workstations. Refer to CISA ICS Advisory ICSA-25-175-01 for vendor-supplied deployment context.

The attacker captures HTTP traffic to the ULC endpoint, extracts the request and response bodies, applies zlib decompression, and parses the resulting structures for credentials or session tokens. No exploit code is required beyond standard packet capture tools and a zlib library.

Detection Methods for CVE-2025-5087

Indicators of Compromise

Plaintext HTTP sessions on ports associated with NAVIS N4 ULC endpoints where HTTPS would be expected.
Unexpected packet capture tools (tcpdump, Wireshark, tshark) running on hosts that share a broadcast domain with ULC workstations or N4 servers.
Successful N4 authentications originating from IP addresses or user agents that do not match the enrolled ULC inventory.

Detection Strategies

Inspect network flows for HTTP traffic to N4 server hostnames and alert on any session that is not wrapped in TLS.
Correlate ULC login events with source IP asset inventory to surface authentications from unmanaged endpoints.
Deploy signatures that flag zlib-compressed HTTP request bodies posted to known ULC URIs from unexpected clients.

Monitoring Recommendations

Log and retain full session metadata for ULC-to-N4 communication, including source IP, destination, user agent, and byte counts.
Monitor switch port and ARP tables for signs of man-in-the-middle staging such as gratuitous ARP or MAC address flapping near ULC subnets.
Alert on new credential use patterns, such as a single N4 account authenticating from geographically dispersed IP addresses within a short window.

How to Mitigate CVE-2025-5087

Immediate Actions Required

Restrict ULC-to-N4 traffic to isolated management VLANs or dedicated VPN tunnels that provide encryption and access control.
Rotate all N4 credentials that may have transited untrusted networks, prioritizing administrative and integration accounts.
Contact Kaleris support to confirm the supported configuration for encrypted transport and to obtain the vendor remediation guidance referenced in ICSA-25-175-01.

Patch Information

Refer to CISA ICS Advisory ICSA-25-175-01 for the vendor's remediation guidance and version-specific fix availability. Operators should engage Kaleris directly to obtain updated NAVIS N4 ULC builds and configuration guidance that enforce TLS between client and server.

Workarounds

Tunnel all ULC traffic through an IPsec or TLS VPN so that HTTP payloads are never exposed on shared network segments.
Terminate ULC connections at a reverse proxy that upgrades the transport to HTTPS with certificate validation, and firewall direct HTTP access to the N4 server.
Segment terminal operating environments from corporate and guest networks, and disable wireless access for hosts running the Ultra Light Client until encrypted transport is enforced.

bash

# Configuration example: block cleartext HTTP to N4 servers at the perimeter
# and require traffic to arrive via the encrypted reverse proxy VIP.
iptables -A FORWARD -p tcp -d <N4_SERVER_IP> --dport 80 -j DROP
iptables -A FORWARD -p tcp -d <N4_SERVER_IP> --dport 443 \
  -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT