CISA published ICSA-26-237-07 on August 25, 2026, disclosing two vulnerabilities in the FURUNO FA-50 Class B Automatic Identification System (AIS) transponder, reported through JPCERT/CC. The advisory is notable less for the vulnerability class — hardcoded credentials and missing authentication are common findings in maritime and industrial OT gear — and more for the remediation reality: FURUNO ended production of the FA-50 in October 2020, and no firmware update is planned. Every deployed unit will carry these flaws for the remainder of its service life.
Vulnerability Details
CVE-2026-59769 — Use of Hard-Coded Credentials (CWE-798)
CVSS 3.1: 9.1 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
All firmware versions of the FA-50 ship with hardcoded authentication credentials protecting the device’s settings screen. An attacker who knows these credentials and has network access to the vessel’s internal systems can use them to modify device configuration, including changing the unit’s Maritime Mobile Service Identity (MMSI) — the identification number the transponder broadcasts to identify the vessel to other ships, VTS (Vessel Traffic Service) operators, and coastal authorities.
CVE-2026-67578 — Missing Authentication for Critical Function (CWE-306)
CVSS 3.1: 7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Independent of the credential issue, certain configuration functions on the FA-50 settings screen enforce no authentication at all. An attacker with access to the vessel’s internal network can manipulate configuration parameters directly, without needing the hardcoded credentials from the first finding.
Both flaws require network access — Attack Vector: Network — but no privileges and no user interaction. Neither carries a confidentiality impact; the risk in both cases is to integrity (and, for the credentials issue, availability), consistent with an attacker’s ability to alter what the device reports and how it operates rather than exfiltrate data from it.
Why AIS Configuration Integrity Matters
AIS transponders are safety-critical navigation equipment mandated under SOLAS for most commercial vessels. A Class B unit like the FA-50 continuously broadcasts vessel identity, position, course, and speed over VHF to nearby ships and shore infrastructure, forming the backbone of traffic separation, collision avoidance, and port/coastal surveillance.
Unauthorized modification of AIS configuration — particularly the MMSI, the identification number broadcast to other ships and VTS (Vessel Traffic Service) operators — has consequences beyond a single vessel. An altered MMSI can create identity conflicts that confuse collision-avoidance systems and tracking platforms; a tampered transponder degrades situational awareness in constrained waterways for everyone nearby. AIS identity manipulation is also a known technique for evading sanctions monitoring and illegal-fishing enforcement, and because this vulnerability affects the settings screen rather than the RF broadcast function, tampering may go unnoticed unless bridge crew actively cross-check the displayed MMSI against vessel documentation.
Attack Surface: The “Internal Network Access” Caveat
Both CVEs require access to the vessel’s internal network — not a remote, internet-facing exploit path. But treating vessel networks as inherently trusted is a weak assumption in practice: bridge and navigation networks are frequently bridged to crew Wi-Fi or satellite communication terminals with weaker perimeter controls; port-side contractors routinely connect diagnostic equipment during maintenance windows; and flat network architectures without VLAN separation remain common on smaller vessels. AIS units are also often networked to chart plotters and ECDIS via NMEA 0183/2000 gateways, any of which becomes a pivot point if compromised through an unrelated flaw. “Internal network access required” is a moderately achievable bar for an attacker with prior vessel network presence, not a reason to deprioritize the finding.
Mitigation: No Patch, Compensating Controls Only
FURUNO’s guidance, reflected in the CISA advisory, is unambiguous: the FA-50 is end-of-life, production ceased in October 2020, and no software update will be issued. Recommended compensating controls:
- Do not connect the FA-50 directly to the internet, including bridging the navigation network to satellite terminals or crew internet without a firewall between them.
- Physically and logically secure the vessel. FURUNO’s advisory stresses that the vessel should be “properly locked and managed” to prevent unauthorized physical or network access — maritime OT security still depends heavily on physical access control.
- Segment navigation/bridge networks from crew, administrative, and internet-facing networks, using a firewall or unidirectional gateway where integration is required.
- Restrict access to the settings screen to authorized bridge officers and certified technicians; treat port-call diagnostic access as controlled, not routine.
- Periodically verify broadcast MMSI and configuration against vessel documentation to detect unauthorized changes.
- Plan for replacement. Given the confirmed end-of-life status, fleet operators should treat this advisory as a forcing function to evaluate transponder replacement, particularly for higher-exposure vessels.
Assessment
ICSA-26-237-07 is a useful reminder that maritime OT carries the same hardcoded-credential and missing-authentication patterns endemic to industrial control systems ashore, with two added complications: safety-of-navigation stakes, and vendor support lifecycles that are often shorter and less predictable than shore-based ICS equipment. Fleet operators and ship management companies should inventory AIS transponder models across their fleets now — end-of-life findings like this one tend to surface only when an advisory forces the question, by which point the exposure has often existed for years.