Medium severity6.3NVD Advisory· Published Jun 4, 2026· Updated Jul 22, 2026
CVE-2026-21404
CVE-2026-21404
Description
NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP functionality is enabled, a local attacker can extract credentials to bypass the intended transfer workflow. Successful authentication against the SOAP interface grants access to privileged WCF methods, enabling an attacker to write or overwrite files within application-defined paths.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
2- github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-155-01.jsonnvdThird Party Advisory
- www.cisa.gov/news-events/ics-advisories/icsa-26-155-01nvdMitigationUS Government Resource
News mentions
1- NAVTOR NavBoxCISA ICS Advisories