CVE-2026-59769: FA-50 Hard-Coded Credentials Vulnerability

CVE-2026-59769 Overview

CVE-2026-59769 affects the Furuno FA-50, a marine Automatic Identification System (AIS) transponder. All versions of the FA-50 ship with hard-coded credentials [CWE-798] embedded in the device firmware. An attacker who knows the credentials and has access to the vessel's internal network can log in to the settings screen and alter the vessel identification number.

The issue was disclosed through Japan's JVN coordination process and confirmed by Furuno in vendor security notices. The vulnerability requires network access to the maritime device but no user interaction and no prior authentication beyond the static credentials.

Critical Impact
An attacker on the vessel's internal network can modify the AIS identification number, corrupting the integrity of vessel identity broadcasts used for maritime traffic and collision avoidance.

Affected Products

Furuno FA-50 AIS transponder — all firmware versions
Vessel networks integrating the FA-50 settings interface
Maritime environments relying on FA-50 identification data

Discovery Timeline

2026-08-25 - CVE-2026-59769 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-59769

Vulnerability Analysis

The FA-50 firmware includes credentials that are fixed at build time and shared across every deployed unit. Any operator, integrator, or attacker who obtains the credentials — through firmware analysis, documentation leaks, or field service exposure — holds permanent authenticated access to every FA-50 in the field.

Once authenticated to the settings interface, an attacker can change the vessel identification number transmitted by the AIS transponder. AIS identification data is a trust anchor for maritime situational awareness, collision avoidance, and vessel traffic services. Altering it undermines the integrity of maritime communications originating from the vessel.

The attack surface is limited to actors with access to the vessel's internal network. However, that boundary is thin on many vessels, where crew networks, service laptops, and satellite links can reach navigation subnets.

Root Cause

The root cause is the use of hard-coded credentials in shipped firmware. Because the credentials cannot be rotated by operators through normal configuration, disclosure of the secret compromises the entire product line rather than an individual unit.

Attack Vector

Exploitation requires network reachability to the FA-50 device and knowledge of the embedded credentials. The attacker authenticates to the settings screen using those credentials and issues configuration changes, including modification of the identification number. No memory corruption or code execution primitive is required; the flaw is a design-level authentication weakness. See the JVN Security Vulnerability Report for coordinated disclosure details.

Detection Methods for CVE-2026-59769

Indicators of Compromise

Unexpected changes to the AIS vessel identification number, MMSI, or related transponder settings.
Authentication events against the FA-50 settings interface from hosts that are not designated maintenance workstations.
New or unknown devices connecting to the navigation VLAN or bridge network segment.

Detection Strategies

Baseline the FA-50 configuration during commissioning and compare current settings on a scheduled cadence.
Monitor AIS broadcasts on and around the vessel for identification changes that do not correspond to authorized voyage events.
Alert on any management traffic to the FA-50 that originates from outside an allowlist of approved service endpoints.

Monitoring Recommendations

Log and forward navigation network traffic to a central analysis platform for review of device access patterns.
Include the FA-50 in vessel asset inventories and network diagrams so anomalous flows are visible during incident response.
Review Furuno advisories on a recurring basis for firmware updates or additional guidance.

How to Mitigate CVE-2026-59769

Immediate Actions Required

Segment the FA-50 onto an isolated navigation VLAN and block access from crew, guest, and general-purpose vessel networks.
Restrict physical and logical access to the bridge network to authorized maintenance personnel only.
Contact Furuno support to confirm the current firmware status and obtain any available remediation guidance.

Patch Information

At time of publication, remediation guidance is provided through Furuno security notices. Review Furuno Security Notice #1857 and Furuno Security Notice #1856 for vendor-issued instructions and any firmware availability specific to your unit.

Workarounds

Enforce strict network access control lists between the FA-50 and any general-purpose vessel or shore-side network.
Disable or physically disconnect maintenance interfaces when they are not actively in use.
Require multi-person authorization for any change to AIS identification settings and log those changes in vessel records.

bash

# Example: restrict access to the FA-50 management interface to a single maintenance host
# Replace addresses with values appropriate for your vessel network

iptables -A FORWARD -s 10.10.20.5/32 -d 10.10.10.15/32 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.10.10.15/32 -j DROP