CVE-2026-21404
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
NAVTOR NavBox up to version 4.16.1.20 contains hard-coded credentials in its Windows Communication Foundation (SOAP) implementation. A local attacker can extract these credentials to bypass the intended transfer workflow and gain access to privileged WCF methods, enabling file write or overwrite within application-defined paths.
Risk Assessment
A local attacker can gain unauthorized access to SOAP functionality, allowing modification of application files, potentially leading to privilege escalation or data integrity compromise.
Recommendation
Update NAVTOR NavBox to the latest version that removes hard-coded credentials. If possible, disable the SOAP functionality if not required.
Other vulnerabilities in NAVTOR NavBox
Original NVD description (English source)
NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP functionality is enabled, a local attacker can extract credentials to bypass the intended transfer workflow. Successful authentication against the SOAP interface grants access to privileged WCF methods, enabling an attacker to write or overwrite files within application-defined paths.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS