CVE-2026-67578: FA-50 Authentication Bypass Vulnerability

CVE-2026-67578 Overview

CVE-2026-67578 affects all versions of the Furuno FA-50, a marine Automatic Identification System (AIS) transponder used on commercial vessels. The product fails to authenticate access to portions of its configuration interface. An attacker with access to the vessel's internal network can reach the settings screen and modify configuration parameters without providing credentials. The weakness is classified as [CWE-306] Missing Authentication for Critical Function. Successful abuse targets the integrity of navigation and communication configuration on affected units.

Critical Impact
A network-adjacent attacker on the vessel LAN can tamper with FA-50 configuration parameters through an unauthenticated settings interface, degrading the integrity of AIS operation.

Affected Products

Furuno FA-50 AIS transponder — all versions
Related Furuno maritime products referenced in vendor security notices
Vessel networks integrating the FA-50 configuration interface

Discovery Timeline

2026-08-25 - CVE-2026-67578 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-67578

Vulnerability Analysis

The FA-50 exposes a configuration interface that does not enforce authentication on selected settings. Any host reachable on the vessel's internal network can render and submit changes to the product's settings screen. Because the transponder participates in AIS broadcasting and navigation data exchange, configuration tampering directly affects the integrity of maritime situational awareness. The advisory scope is limited to integrity impact; confidentiality and availability are not identified as directly affected by this specific issue.

Root Cause

The root cause is Missing Authentication for Critical Function [CWE-306]. Configuration endpoints that should be gated by a credential check are exposed to any client that can route to the device. The product assumes that presence on the internal network is sufficient authorization, a common design flaw in embedded maritime and industrial equipment.

Attack Vector

Exploitation requires network reachability to the FA-50 management interface. On typical vessel deployments, the transponder shares a flat LAN with bridge equipment, crew workstations, and sometimes shore-connectivity routers. An attacker who gains a foothold on that LAN — through a compromised workstation, a rogue Wi-Fi bridge, or an exposed remote-access appliance — can issue configuration changes without credentials. No user interaction is required. See the JVN Security Advisory and Furuno Security Notice #1857 for vendor detail.

No verified exploit code is publicly available. Technical exploitation would consist of an HTTP or proprietary protocol request to the unauthenticated settings endpoint, submitting altered configuration values.

Detection Methods for CVE-2026-67578

Indicators of Compromise

Unexpected changes to FA-50 configuration parameters observed on the settings screen or in vendor logs.
Configuration write requests to the FA-50 management interface originating from hosts other than authorized bridge workstations.
AIS transmission anomalies such as altered vessel identifiers, static data, or reporting intervals not matching operator intent.

Detection Strategies

Baseline the FA-50 configuration and periodically compare live settings against the known-good baseline.
Monitor vessel LAN traffic for HTTP or proprietary requests targeting the transponder's management endpoints from unexpected sources.
Alert on any device joining the OT segment that has not been inventoried by the vessel's IT/OT asset management process.

Monitoring Recommendations

Forward network flow and syslog data from bridge and OT segments to a central analytics platform for correlation and retention.
Track authentication and administrative events on jump hosts and workstations used to manage maritime equipment.
Review shore-to-ship remote access sessions for scope and duration, and alert on off-hours activity toward navigation systems.

How to Mitigate CVE-2026-67578

Immediate Actions Required

Apply the firmware update or mitigation guidance published by Furuno in Furuno Security Notice #1857 and Furuno Security Notice #1856.
Restrict network reachability to the FA-50 management interface to a small allow-list of authorized bridge hosts.
Audit current FA-50 configuration against the vessel's approved baseline and revert unauthorized changes.
Inventory all devices on the vessel LAN and remove or isolate systems that do not require access to navigation equipment.

Patch Information

Refer to the JVN Security Advisory for the coordinated disclosure summary and to the Furuno security notices for firmware availability and installation instructions specific to each affected model. Because the advisory states "all versions" are affected, operators should confirm the fixed firmware version directly with Furuno or an authorized service provider before scheduling installation.

Workarounds

Segment the vessel network so the FA-50 and other OT devices reside on an isolated VLAN with strict ACLs.
Place a filtering device between IT and OT segments and permit only required management traffic from designated hosts.
Disable or physically isolate any unused network ports on bridge switches to prevent rogue device attachment.
Enforce strong authentication and session monitoring on any shore-to-ship remote access path that can reach the OT segment.

bash

# Configuration example - illustrative ACL restricting access to the FA-50 management interface
# Replace <FA50_IP> and <BRIDGE_MGMT_IP> with values from your vessel network design
access-list OT_TO_FA50 permit tcp host <BRIDGE_MGMT_IP> host <FA50_IP> eq 80
access-list OT_TO_FA50 permit tcp host <BRIDGE_MGMT_IP> host <FA50_IP> eq 443
access-list OT_TO_FA50 deny   ip any host <FA50_IP> log
access-list OT_TO_FA50 permit ip any any