Is CVE-2026-67578 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-67578

FURUNO ELECTRIC CO., LTD. notes that production of this product ended in October 2020, and software updates will no longer be provided. FURUNO recommends users do not connect the product directly to the internet. To prevent unauthorized access, the vessel on which the product is installed should be properly locked and managed. CISA recommends minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, locating control system networks and remote devices behind firewalls and isolating them from business networks, and using secure methods such as VPNs when remote access is required.

Quick answers

What is CVE-2026-67578?: FURUNO ELECTRIC CO., LTD. notes that production of this product ended in October 2020, and software updates will no longer be provided. FURUNO recommends users do not connect the product directly to the internet. To prevent unauthorized access, the vessel on which the product is installed should be properly locked and managed. CISA recommends minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, locating control system networks and remote devices behind firewalls and isolating them from business networks, and using secure methods such as VPNs when remote access is required.
How severe is CVE-2026-67578?: critical, CVSS 9.1
Is CVE-2026-67578 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-67578 be mitigated?: FURUNO ELECTRIC CO., LTD. notes that production of this product ended in October 2020, and software updates will no longer be provided. FURUNO recommends users do not connect the product directly to the internet. To prevent unauthorized access, the vessel on which the product is installed should be properly locked and managed. CISA recommends minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, locating control system networks and remote devices behind firewalls and isolating them from business networks, and using secure methods such as VPNs when remote access is required.

CISA Warns of Critical Hard-Coded Credential Vulnerabilities in FURUNO FA-50 Class B AIS Transponder

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an Industrial Control Systems advisory warning of two vulnerabilities affecting the FURUNO FA-50 Class B Automatic Identification System (AIS) Transponder. The device, which ended production in October 2020, is affected by CVE-2026-59769 and CVE-2026-67578. CVE-2026-59769, rated CRITICAL with a CVSS v3.1 score of 9.1, involves the use of hard-coded credentials that could allow an attacker with network access to alter device settings. CVE-2026-67578, rated HIGH with a CVSS v3.1 score of 7.5, involves missing authentication for critical functions on the management screen. No known public exploitation has been reported, but the end-of-life status of the product means remaining deployed units face persistent risk without future software updates from the vendor.

12m

CVE-2026-67578

Quick answers

Related News

CISA Warns of Critical Hard-Coded Credential Vulnerabilities in FURUNO FA-50 Class B AIS Transponder