Critical Hard-Coded Cryptographic Key Vulnerabilities Discovered in Wärtsilä FOS-Onboard

The Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICS-26-258-02 on September 15, 2026, detailing two critical vulnerabilities affecting Wärtsilä FOS-Onboard version 5.07.0923.01. The first, CVE-2026-78225, is a hard-coded cryptographic server key vulnerability in the deployer-ng Update Controller component. The second, CVE-2026-81855, is a hard-coded cryptographic client authentication key vulnerability in the robot testing framework component.

According to the advisory, successful exploitation of either vulnerability could allow an attacker to deliver an unauthorized update, execute code, or extract credentials to impersonate a privileged client. CVSS v3.1 base scores are 9.1 for CVE-2026-78225 and 9.3 for CVE-2026-81855, both rated CRITICAL. Corresponding CVSS v4.0 scores are 9.5 and 9.3 respectively.

Wärtsilä has stated that the vulnerabilities are not exploitable when the product is installed as recommended and has developed a security patch. Users are directed to contact Wärtsilä to obtain and install the latest patch via the vendor's ICS patch deployment portal. The relevant CWEs for both vulnerabilities are CWE-321 (Use of Hard-coded Cryptographic Key).

CISA recommends that organizations minimize network exposure for all control system devices, ensure they are not accessible from the internet, and locate control system networks behind firewalls isolated from business networks. When remote access is required, more secure methods such as VPNs should be used. CISA also reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

The vulnerabilities were reported to Wärtsilä and CISA by Cydome Security Ltd. As of the advisory publication, no confirmed active exploitation in the wild has been reported.