VULNERABILITY INTELLIGENCE

CVE-2026-21404

CVSS score5.8 MEDIUM
EPSS probability0.12%
CISA KEVNot currently listed
Published2026-06-04
Last modified2026-07-22
CVSS vectorCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Description

NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP functionality is enabled, a local attacker can extract credentials to bypass the intended transfer workflow. Successful authentication against the SOAP interface grants access to privileged WCF methods, enabling an attacker to write or overwrite files within application-defined paths.

Weakness classification

  • CWE-798: Use of Hard-coded Credentials

Primary references