CVE-2026-21404

NAVTOR NavBox Use of Hard-coded Credentials

CVSS 5.8 MEDIUMEPSS 0.1%CWE-798

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.8EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

04 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP functionality is enabled, a local attacker can extract credentials to bypass the intended transfer workflow. Successful authentication against the SOAP interface grants access to privileged WCF methods, enabling an attacker to write or overwrite files within application-defined paths.

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

NAVTOR · NavBox

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-155-01.json https://www.cisa.gov/news-events/ics-advisories/icsa-26-155-01