Vulnerabilities

TI-2026-17296 CVE-2026-21404 · GHSA-x454-wfv6-72h8

NAVTOR NavBox Use of Hard-coded Credentials

LOW 25

NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation.

CVSS 4.0MEDIUM 5.8 Local Low privileges No interaction EPSS 0.00122 Published 2026-06-04 Fixed in 4.17.2.6 CWE-798

TI-2026-02359 CVE-2026-2754 · GHSA-5545-c88g-wqpf

MEDIUM 40

Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00568 Published 2026-03-06 Fixed in 4.16.2.4 CWE-306

TI-2026-02358 CVE-2026-2753 · GHSA-7j6h-j855-chvw

LOW 39

An Absolute Path Traversal vulnerability exists in Navtor NavBox.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00528 Published 2026-03-06 Fixed in 4.14.1.2 CWE-36

TI-2026-02357 CVE-2026-2752 · GHSA-cv33-x5rj-6f75

LOW 30

Navtor NavBox allows information disclosure via the /api/ais-data endpoint.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00306 Published 2026-03-06 Fixed in 4.16.2.4 CWE-209