CVE-2026-21404 describes a vulnerability in NAVTOR NavBox through version 4.16.1.20 where hard-coded credentials exist within the SOAP interface of the Windows Communication Foundation implementation. If SOAP is enabled, a local attacker with limited privileges can extract these credentials and authenticate against the SOAP interface. This authentication grants access to privileged WCF methods, enabling file write or overwrite operations within paths defined by the application. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) and has a CVSS 4.0 score of 5.8, indicating medium severity. No patch or official remediation level has been published by the vendor.

Successful exploitation allows a local attacker to bypass intended transfer workflows by using extracted hard-coded credentials to authenticate to the SOAP interface. This grants access to privileged methods that can write or overwrite files in application-defined locations, potentially leading to unauthorized modification of application data or behavior. The vulnerability requires local access and high attack complexity, limiting remote exploitation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the SOAP functionality if it is not required, to reduce the attack surface. Monitor local access controls to prevent unauthorized local users from exploiting this vulnerability.