NAVTOR NavBox CVE-2026-21404

NAVTOR NavBox relies on Windows Communication Foundation (WCF), Microsoft's SOAP-based messaging framework, for its data transfer workflows - flagged by the 'Microsoft' tag in the advisory metadata. CWE-798 (Use of Hard-coded Credentials) describes a design flaw where fixed authentication tokens are baked into the application binary or configuration at build time, rather than being dynamically provisioned. An attacker can recover these credentials through binary reverse engineering, file inspection, or memory analysis without exploiting any memory-safety bug. Once recovered, the credentials authenticate against the WCF SOAP interface, which exposes privileged methods gated by those same static tokens. The resulting capability - writing or overwriting files within application-defined paths - is a high-impact primitive in a maritime navigation system, where integrity of navigation databases, route files, or configuration data directly affects operational safety. No CPE string was provided in the available data; affected scope is defined by the vendor advisory.