CISA Warns of Critical Hard-Coded Credential Vulnerabilities in FURUNO FA-50 Class B AIS Transponder

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-26-237-07 on August 25, 2026, disclosing two vulnerabilities in the FURUNO FA-50 Class B AIS Transponder. The device is used globally in maritime navigation to broadcast vessel position and safety information.

CVE-2026-59769 has a CVSS v3.1 base score of 9.1 (CRITICAL). The vulnerability stems from the use of hard-coded credentials. An attacker who knows the credentials and has access to the in-vessel network to which the device is connected may operate the settings screen using those credentials to alter the settings of the device.

CVE-2026-67578 has a CVSS v3.1 base score of 7.5 (HIGH). Some configurations may be changed on the management screen without authentication.

FURUNO ELECTRIC CO., LTD., the vendor, notes that production of the FA-50 Class B AIS Transponder ended in October 2020, and software updates will no longer be provided. The advisory states that no patch is available. FURUNO recommends that users do not connect the product directly to the internet and that the vessel on which the product is installed should be properly locked and managed to prevent unauthorized access.

The relevant CWEs are CWE-798 (Use of Hard-coded Credentials) for CVE-2026-59769 and CWE-306 (Missing Authentication for Critical Function) for CVE-2026-67578.

The vulnerabilities affect all product versions (vers:all/*). The vendor's headquarters are in Japan, and the devices are deployed worldwide. CISA recommends minimizing network exposure for control system devices, ensuring they are not accessible from the internet, locating control system networks behind firewalls, and isolating them from business networks. Organizations observing suspected malicious activity are encouraged to report findings to CISA for tracking and correlation.