CVE-2026-67578
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to alter device settings. The following versions of FURUNO FA-50 Class B AIS Transponder are affected: FURUNO FA-50 Class B AIS Transponder vers:all/* CVSS Vendor Equipment Vulnerabilities v3 9.1 FURUNO ELECTRIC CO.,LTD. FURUNO FA-50 Class B AIS Transponder Use of Hard-coded Credentials, Missing Authentication for Critical Function Background Critical Infrastructure Sectors: Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: Japan Vulnerabilities Expand All + CVE-2026-59769 An attacker, who knows the credentials and has access to the in-vessel network to which the device is connected to, may operate the settings screen using that credentials to alter the settings of the device. View CVE Details Affected Products FURUNO FA-50 Class B AIS Transponder Vendor: FURUNO ELECTRIC CO.,LTD. Product Version: FURUNO FA-50 Class B AIS Transponder: vers:all/* Product Status: known_affected Remediations Mitigation FURUNO ELECTRIC CO.,LTD. notes that production of this product ended in October 2020, and software updates will no longer be provided. FURUNO recommends users do not connect the product directly to the internet. To prevent unauthorized access, the vessel on which the product is installed should be properly locked and managed. Relevant CWE: CWE-798 Use of Hard-coded Credentials Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H 4.0 8.8 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2026-67578 Some configurations may be changed on the management screen without authentication. View CVE Details Affected Products FURUNO FA-50 Class B AIS Transponder Vendor: FURUNO ELECTRIC CO.,LTD. Product Version: FURUNO FA-50 Class B AIS Transponder: vers:all/* Product Status: known_affected Remediations Mitigation FURUNO ELECTRIC CO.,LTD. notes that production of thi
CSIRTS triage
- What
- FURUNO FA-50 uses hard-coded credentials and lacks authentication for critical functions, allowing network-connected attackers to alter device settings.
- Who is affected
- All FURUNO FA-50 AIS transponders deployed worldwide on vessels with access to the in-vessel network.
- Urgency
- Critical; hard-coded credentials and missing authentication allow any network attacker to modify critical maritime safety device settings.
- Action
- Contact FURUNO for firmware updates that implement proper authentication and remove hard-coded credentials.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-67578
Get an email if CVE-2026-67578 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
Advisory coverage (3)
- unknownFURUNO ELECTRIC FA-50 CLASS B AIS TRANSPONDER uses hard-coded credentials and misses authentication for additi…jvn · 2026-08-26
- criticalFURUNO FA-50 Class B AIS Transpondercisa · 2026-08-25
- highCVE-2026-67578: FA-50 all versions miss authentication for some configuration. An attacker with access to the …nvd · 2026-08-25
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-67578)