CVE-2026-21404

Name of the Vulnerable Software and Affected Versions NAVTOR NavBox versions prior to 4.16.1.21

Description The software contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. When SOAP functionality is enabled, a local attacker can extract these credentials to bypass the intended transfer workflow. Successful authentication against the SOAP interface provides access to privileged WCF methods, allowing an attacker to write or overwrite files within application-defined paths.

Recommendations Update to a version later than 4.16.1.20. As a temporary mitigation, disable the SOAP functionality to prevent credential extraction and unauthorized access to WCF methods.