CVE-2026-21404: CWE-798 Use of Hard-coded Credentials in NAVTOR NavBox
NAVTOR NavBox versions up to and including 4.16.1.20 contain hard-coded credentials in their Windows Communication Foundation (SOAP) implementation. If SOAP functionality is enabled, a local attacker can extract these credentials to bypass intended transfer workflows. Successful authentication via the SOAP interface allows access to privileged methods that can write or overwrite files within application-defined paths. This vulnerability has a medium severity rating with a CVSS score of 5.8.
AI Analysis
Technical Summary
CVE-2026-21404 identifies a vulnerability in NAVTOR NavBox through version 4.16.1.20 where hard-coded credentials exist within the SOAP implementation of the Windows Communication Foundation. When SOAP functionality is enabled, a local attacker can extract these credentials and authenticate against the SOAP interface. This grants access to privileged WCF methods, enabling the attacker to write or overwrite files in application-defined locations. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) and has a CVSS 4.0 base score of 5.8, indicating medium severity. No official patch or remediation level has been provided by the vendor as of the published date.
Potential Impact
An attacker with local access can extract hard-coded credentials from the SOAP interface and authenticate with elevated privileges. This allows the attacker to write or overwrite files within application-defined paths, potentially leading to unauthorized modification of application data or behavior. The vulnerability compromises the integrity of the affected system components.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the SOAP functionality if it is not required to reduce exposure. Monitor for vendor updates regarding patches or official mitigations.
CVE-2026-21404: CWE-798 Use of Hard-coded Credentials in NAVTOR NavBox
Description
NAVTOR NavBox versions up to and including 4.16.1.20 contain hard-coded credentials in their Windows Communication Foundation (SOAP) implementation. If SOAP functionality is enabled, a local attacker can extract these credentials to bypass intended transfer workflows. Successful authentication via the SOAP interface allows access to privileged methods that can write or overwrite files within application-defined paths. This vulnerability has a medium severity rating with a CVSS score of 5.8.
CVSS v4.0
Score 5.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-21404 identifies a vulnerability in NAVTOR NavBox through version 4.16.1.20 where hard-coded credentials exist within the SOAP implementation of the Windows Communication Foundation. When SOAP functionality is enabled, a local attacker can extract these credentials and authenticate against the SOAP interface. This grants access to privileged WCF methods, enabling the attacker to write or overwrite files in application-defined locations. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials) and has a CVSS 4.0 base score of 5.8, indicating medium severity. No official patch or remediation level has been provided by the vendor as of the published date.
Potential Impact
An attacker with local access can extract hard-coded credentials from the SOAP interface and authenticate with elevated privileges. This allows the attacker to write or overwrite files within application-defined paths, potentially leading to unauthorized modification of application data or behavior. The vulnerability compromises the integrity of the affected system components.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the SOAP functionality if it is not required to reduce exposure. Monitor for vendor updates regarding patches or official mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- icscert
- Date Reserved
- 2026-01-27T23:33:47.825Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a21e829e29bf47b50d078eb
Added to database: 06/04/2026, 21:03:37 UTC
Last enriched: 06/12/2026, 10:30:29 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 87
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.