FURUNO FA-50 Class B AIS Transponder: Hardcoded Credentials and Missing Auth Vulnerabilities (CVE-2026-59769, CVE-2026-67578)

Vulnerability Overview Vulnerability ID: JVN#U95422936 Product Name: FURUNO ELECTRIC FA-50 CLASS B AIS TRANSPONDER Vulnerability Types: - Use of Hard-coded Credentials (CVE-790) - Missing Authentication for Critical Function (CVE-306) Impact Scope Affected Products: All versions of FA-50 Vulnerability Details: - Use of Hard-coded Credentials: - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VH:H/VA:N/SC:N/SI:N/SA:N Base Score 8.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Base Score 9.1 - CVE-2026-59769 - Missing Authentication for Critical Function: - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VH:H/VA:N/SC:N/SI:N/SA:N Base Score 8.7 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Base Score 7.5 - CVE-2026-67578 Remediation Solution: - This product was discontinued in October 2020 and no longer receives software updates. - Users are advised to take the following measures: - Secure the vessels where the product is installed to prevent unauthorized access. - Do not connect the product directly to the Internet. - It is recommended to switch to the successor product (FA-70), which is not affected by these vulnerabilities. Additional Information Reference Links: - JPCERT/CC Addendum - Vulnerability Analysis by JPCERT/CC - Credit: Souvik Kandar reported these issues to CISA ICS. JPCERT/CC coordinated with the vendor as requested by the vendor and CISA ICS. Summary The FURUNO ELECTRIC FA-50 CLASS B AIS TRANSPONDER contains vulnerabilities related to the use of hard-coded credentials and missing authentication for critical functions, affecting all versions. Since the product has been discontinued, users are advised to implement physical security measures and consider upgrading to the successor product.

Goal Reached Thanks to every supporter — we hit 100%!

FURUNO FA-50 Class B AIS Transponder: Hardcoded Credentials and Missing Auth Vulnerabilities (CVE-2026-59769, CVE-2026-67578)

More from this source