CVE-2025-2566 Kaleris CVE debrief

Who should care

Kaleris Navis N4 administrators, OT/terminal operations teams, and security owners responsible for systems that expose the Ultra Light Client or related N4 services to untrusted networks, especially internet-facing deployments.

Technical summary

The advisory describes an unsafe Java deserialization weakness in NAVIS N4 ULC. The attack does not require authentication, and the outcome can be arbitrary code execution on the server if a crafted request reaches the vulnerable component. The CSAF lists affected products as Kaleris Navis N4 <4.0 and provides fixed versions for supported branches: 3.1.44+, 3.2.26+, 3.3.27+, 3.4.25+, 3.5.18+, 3.6.14+, 3.7.0+, and 3.8.0+. It also notes N4 4.0 as a longer-term option because the Ultra Light Client is replaced with the HTML UI.

Defensive priority

Immediate

Recommended defensive actions

• Upgrade to a fixed Navis N4 release for your branch: 3.1.44+, 3.2.26+, 3.3.27+, 3.4.25+, 3.5.18+, 3.6.14+, 3.7.0+, or 3.8.0+, or move to N4 4.0.
• If N4 does not need to be internet-facing, place it behind a firewall and remove external exposure.
• If CAP must remain exposed, disable the Ultra Light Client on exposed nodes by blocking the ULC URL patterns at the load balancer or firewall, or by disabling the endpoint in web.xml and restarting the server.
• Prefer a secure VPN, authenticated jump host, or VDI access path for any required external users rather than direct public exposure.
• Limit the number of internet-exposed N4 nodes, ensure HTTPS/TLS is correctly configured on the load balancer, and use perimeter protections with DDoS detection.
• Verify that the vendor guidance has been applied across all affected environments and coordinate with [email protected] if you need clarification or support.

Evidence notes

The supplied CISA CSAF advisory (ICSA-25-175-01) published on 2025-06-24 states that Kaleris NAVIS N4 ULC contains an unsafe Java deserialization vulnerability and that an unauthenticated attacker can execute arbitrary code on the server via specially crafted requests. The advisory’s affected product entry is Kaleris Navis N4: <4.0. Remediation entries list version-specific fixes for supported branches and defensive mitigations for reducing or removing ULC exposure. The supplied dates for publication and modification are both 2025-06-24T06:00:00Z, which should be treated as the issue timing context.

Official resources