Threats affecting pkg:github/navtor/navbox

NAVTOR NavBox versions up to and including 4.16.1.20 contain hard-coded credentials in their Windows Communication Foundation (SOAP) implementation. If SOAP functionality is enabled, a local attacker can extract these credentials to bypass intended transfer workflows. Successful authentication via the SOAP interface allows access to privileged methods that can write or overwrite files within application-defined paths. This vulnerability has a medium severity rating with a CVSS score of 5.8.