NAVTOR NavBox Vulnerability Advisory
NAVTOR NavBox Vulnerability Advisory 🚨
A vulnerability, CVE-2026-21404, has been identified in NAVTOR NavBox through version 4.16.1.20. Successful exploitation of this vulnerability could allow a local attacker to gain unauthorized access to SOAP methods, resulting in a disruption of operations. The affected systems are deployed worldwide within Critical Infrastructure Sectors, specifically Information Technology.
NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation. If the SOAP functionality is enabled, a local attacker can extract credentials to bypass the intended transfer workflow. Successful authentication against the SOAP interface grants access to privileged WCF methods, enabling an attacker to write or overwrite files within application-defined paths. The relevant CWE is CWE-798 Use of Hard-coded Credentials. This vulnerability was reported to CISA by Cydome Security Ltd.
NAVTOR has released a patch for NavBox in April 2026, with version 4.17.2.6 and later including the fix. Users that have an active NavBox connection will automatically be kept up to date with the latest version, requiring no user action. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely and has a high attack complexity.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. This includes minimizing network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Additionally, CISA advises locating control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures and encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
For more details, Read full article 🌐