Vulnerability intelligence

CVE-2026-21404

NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP functionality is enabled, a local attacker can extract credentials to bypass the intended transfer workflow. Successful authentication against the SOAP interface grants access to privileged WCF methods, enabling an attacker to write or overwrite files within application-defined paths.

CVSS Score

5.8

Medium

EPSS — Exploit Probability

0.1%

Riskier than 2% of all CVEs · checked 2026-09-08

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories

NVD entry

1 article across 1 outlet · first covered Jun 4, 2026 · latest Jun 4, 2026

Coverage timeline

NAVTOR NavBox
www.cisa.gov · Jun 4, 2026