CVE-2018-5386— Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leak

EPSS 3.18% · P87 Updated Feb 21, 2026

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2018-5386

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leak

Source: NVD (National Vulnerability Database)

Vulnerability Description

Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak.

Source: NVD (National Vulnerability Database)

CVSS Information

N/A

Source: NVD (National Vulnerability Database)

Vulnerability Type

使用候选路径或通道进行的认证绕过

Source: NVD (National Vulnerability Database)

Vulnerability Title

Navarino Infinity 信息泄露漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Navarino Infinity是希腊Navarino公司的一套海事带宽管理和优化解决方案。该方案能够用于配备多种类型的船舶。 Navarino Infinity 2.2之前版本中存在信息泄露漏洞。远程攻击者可利用该漏洞绕过身份验证机制，获取信息。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Navarino	Infinity	2.2 ~ 2.2	-

II. Public POCs for CVE-2018-5386

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2018-5386

Please Login to view more intelligence information

https://medium.com/%40evstykas/pwning-ships-vsat-for-fun-and-profit-ba0fe9f42fb3x_refsource_MISC
https://packetstormsecurity.com/files/146506/Navarino-Infinity-Blind-SQL-Injection-Session-Fixation.htmlx_refsource_MISC
http://www.securityfocus.com/bid/103544vdb-entryx_refsource_BID
https://www.kb.cert.org/vuls/id/184077third-party-advisoryx_refsource_CERT-VN
https://nvd.nist.gov/vuln/detail/CVE-2018-5386

Same Patch Batch · Navarino · 2018-07-24 · 3 CVEs total

CVE-2018-5384		Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that i
CVE-2018-5385		Navarino Infinity web interface up to version 2.2 is prone to session fixation attacks

IV. Related Vulnerabilities

Same product: Infinity

Same vendor: Navarino

Same weakness: CWE-288

V. Comments for CVE-2018-5386

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2018-5386— Some Navarino Infinity functions placed in the URL can bypass any authentication mechanism leading to an information leak

I. Basic Information for CVE-2018-5386

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2018-5386

III. Intelligence Information for CVE-2018-5386

Same Patch Batch · Navarino · 2018-07-24 · 3 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2018-5386

Leave a comment