CYBERSIXT Signal Over Noise
All CVEs
Vulnerability intelligence

CVE-2026-21404

CWE-798

NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP functionality is enabled, a local attacker can extract credentials to bypass the intended transfer workflow. Successful authentication against the SOAP interface grants access to privileged WCF methods, enabling an attacker to write or overwrite files within application-defined paths.

CVSS Score
—
Medium
EPSS — Exploit Probability
0.1%
Riskier than 2% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
unknown
Check vendor advisories
NVD entry

1 article across 1 outlet · first covered Jun 4, 2026 · latest Jun 4, 2026

Coverage timeline