Kaleris Navis N4 terminal OS remote code execution flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Critical Java deserialization and cleartext transmission vulnerabilities in Kaleris Navis N4 allow remote code execution and credential theft.
Kaleris Navis N4, a terminal operating system deployed worldwide in transportation and port operations, contains two significant vulnerabilities affecting versions prior to 4.0. CVE-2025-2566 is an unsafe Java deserialization flaw in the Ultra Light Client component that allows unauthenticated remote attackers to execute arbitrary code via specially crafted requests, rated CVSS 9.8 (v3.1) and 9.3 (v4). CVE-2025-5087 involves cleartext transmission of zlib-compressed data over HTTP, exposing credentials and sensitive information to network eavesdropping, rated CVSS 5.9 (v3.1) and 6.0 (v4).
The vulnerabilities are triggered through the Ultra Light Client endpoint when exposed to untrusted networks. Kaleris has released patched versions across multiple release lines (3.1.44+, 3.2.26+, 3.3.27+, 3.4.25+, 3.5.18+, 3.6.14+, 3.7.0+, 3.8.0+) and recommends immediate upgrade to version 4.0, which replaces the vulnerable ULC with an HTML UI. CISA reports no known active exploitation of these vulnerabilities as of June 2025.
Defenders should prioritize patching affected systems or, if immediate patching is infeasible, disable the Ultra Light Client by blocking jnlp and /ulc URLs at the firewall or load balancer, enforce HTTPS/TLS termination, restrict internet exposure, and use VPN or authenticated jump systems for required remote access.
Mentioned in this report
Detection guidance
Java Process Spawning Shell With Download or Recon Commands
A Java process (such as a terminal OS app server) spawning cmd or PowerShell with download, encoding or recon arguments, consistent with post-deserialization RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Spawning Shell With Download or Recon Commands
id: 8260bfc8-78d9-5823-924c-27cf9c9a827c
status: experimental
description: Detects a Java process spawning cmd.exe or PowerShell with download,
encoded-command or reconnaissance arguments. This is a typical post-exploitation
pattern after unsafe Java deserialization RCE, for example in the Navis N4 Ultra
Light Client (CVE-2025-2566). Generalises on the parent/child relation plus suspicious
arguments.
tags:
- attack.execution
- attack.t1202
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
selection_args:
CommandLine|contains:
- whoami
- certutil
- bitsadmin
- Invoke-WebRequest
- DownloadString
- DownloadFile
- -enc
- net user
- net group
- nltest
- curl
- mshta
condition: selection_parent and selection_child and selection_args
falsepositives:
- Java-based build or deployment tools (e.g. Jenkins agents) running scripted commands
on servers
- Administrators running diagnostic scripts launched from a Java management console
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-01
Request to Ultra Light Client ULC or JNLP Endpoint
Web requests to /ulc paths or .jnlp files, the exposed Navis N4 Ultra Light Client surface (CVE-2025-2566/CVE-2025-5087). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Request to Ultra Light Client ULC or JNLP Endpoint
id: 8cd7d0d3-5c41-5cbd-92d8-e1b9cc83bd50
status: experimental
description: Detects HTTP requests to /ulc paths or .jnlp files, the Kaleris Navis
N4 Ultra Light Client endpoint affected by unsafe deserialization RCE (CVE-2025-2566)
and cleartext data exposure (CVE-2025-5087). Hits from untrusted or external source
addresses indicate exposure or probing and should be reviewed. Kaleris recommends
blocking these URLs when the ULC is not needed.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_ulc:
cs-uri-stem|contains: /ulc
selection_jnlp:
cs-uri-stem|endswith: .jnlp
condition: 1 of selection_*
falsepositives:
- Legitimate terminal operators launching the Ultra Light Client from internal networks
- Authorised vulnerability scanners enumerating the application
level: low
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-01
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs