CISA 2026-06-04

NAVTOR NavBox

CVE-2026-21404

Machine-generated analysis · WAYSCloud LLM

The advisory states that hard-coded credentials in NavBox's SOAP implementation could allow a local attacker to bypass authentication and access privileged file operations.

Context

NAVTOR NavBox is a product used in information technology, deployed worldwide. The advisory states that versions up to 4.16.1.20 contain hard-coded credentials in its Windows Communication Foundation (SOAP) implementation, which could allow a local attacker to gain unauthorized access to privileged WCF methods. Successful exploitation may result in the ability to write or overwrite files in application-defined paths. The vendor has released a patch in version 4.17.2.6, and users with active connections are automatically updated.

Operator considerations

Check: Determine if NavBox versions prior to 4.17.2.6 are in use.
Patch: Upgrade to NavBox version 4.17.2.6 or later, or ensure automatic updates are active.
Log: Monitor for unauthorized access to SOAP interfaces if the system is exposed to untrusted users.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow a local attacker to gain unauthorized access to SOAP methods, resulting in a disruption of operations.

The following versions of NAVTOR NavBox are affected:

NavBox 4.16.1.20 (CVE-2026-21404)

Vendor

Equipment

NAVTOR

NAVTOR NavBox

Use of Hard-coded Credentials

Critical Infrastructure Sectors: Information Technology

Countries/Areas Deployed: Worldwide

Company Headquarters Location: Norway

NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP functionality is enabled, a local attacker can extract credentials to bypass the intended transfer workflow. Successful authentication against the SOAP interface grants access to privileged WCF methods, enabling an attacker to write or overwrite files within application-defined paths.

N...

Read the full advisory on CISA →