CVE-2026-78225: Wärtsilä FOS-Onboard Hardcoded Key Flaw

CVE-2026-78225 Overview

CVE-2026-78225 is a hardcoded cryptographic server key vulnerability [CWE-321] in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard. The FOS-Onboard platform is deployed in maritime operational technology (OT) environments, where the Update Controller manages patch and software deployment to onboard vessel systems. An attacker who obtains the embedded key can impersonate the trusted server, sign malicious update payloads, or decrypt protected communications. CISA published the issue in ICS Advisory ICSA-26-258-02.

Critical Impact
A network-based attacker with knowledge of the hardcoded key can compromise the confidentiality and integrity of the update channel and pivot into connected onboard systems.

Affected Products

Wärtsilä FOS-Onboard
deployer-ng Update Controller component
Onboard maritime OT environments running vulnerable FOS-Onboard builds

Discovery Timeline

2026-09-15 - CVE-2026-78225 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-78225

Vulnerability Analysis

The deployer-ng Update Controller ships with a cryptographic server key embedded directly in its distributed binaries or configuration. Because the key is identical across every FOS-Onboard deployment, extracting it from a single instance yields authentication material valid against all others. Attackers can leverage the key to authenticate to the update service, forge signed update artifacts, or decrypt traffic that relies on the same secret. In a maritime OT context, the Update Controller sits at a control boundary and is trusted to push code to downstream systems, so compromise of that trust anchor cascades to any component that accepts updates from it.

Root Cause

The root cause is the use of a hardcoded cryptographic key inside the deployer-ng component, categorized under [CWE-321]: Use of Hard-coded Cryptographic Key. The key was not generated per installation and is not rotated during deployment, so it functions as a shared secret across all instances. Anyone with access to a firmware image, an installer, or an operational unit can recover the key and reuse it elsewhere.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction, though exploitation complexity is elevated because the attacker must first extract the embedded key from a FOS-Onboard artifact. Once extracted, the attacker can reach the Update Controller service over the network, present the key as a legitimate server or client credential, and interact with the update workflow. Successful exploitation impacts the confidentiality, integrity, and availability of FOS-Onboard and any subsystems that trust deployments originating from deployer-ng.

No public proof-of-concept exploit is currently listed for this CVE. Refer to the CISA ICS Advisory ICSA-26-258-02 and the GitHub CSAF JSON File for the authoritative technical description.

Detection Methods for CVE-2026-78225

Indicators of Compromise

Unexpected inbound network sessions to the deployer-ng Update Controller from hosts outside the documented management network.
Update deployments or configuration pushes that do not correlate with an authorized change ticket or maintenance window.
New or modified binaries on downstream onboard systems whose provenance traces back to the Update Controller outside of scheduled patch cycles.

Detection Strategies

Baseline the normal set of clients, source addresses, and TLS session parameters that interact with the Update Controller, and alert on deviations.
Inspect update payload signatures and metadata against an out-of-band manifest maintained by the vessel operator, not solely against what deployer-ng presents.
Correlate authentication events on the Update Controller with change management records to surface unauthorized sessions that use valid-looking credentials.

Monitoring Recommendations

Forward Update Controller logs, TLS handshake records, and deployment audit trails to a centralized OT-aware logging pipeline for retention and analysis.
Monitor east-west traffic between the Update Controller and onboard subsystems for command patterns that fall outside documented update workflows.
Track file integrity on onboard endpoints receiving updates so that unexpected binary changes trigger investigation.

How to Mitigate CVE-2026-78225

Immediate Actions Required

Contact Wärtsilä through the Wärtsilä ICS Patch Deployment service to obtain the fixed FOS-Onboard release and coordinate rollout.
Restrict network reachability to the deployer-ng Update Controller to a dedicated management VLAN and explicitly allowlisted maintenance hosts.
Audit historical Update Controller logs for suspicious sessions or update pushes that predate the mitigation.

Patch Information

Wärtsilä is coordinating remediation through its ICS Patch Deployment program. Operators should reference CISA ICS Advisory ICSA-26-258-02 for the vendor-supplied fixed versions and follow Wärtsilä guidance for staged deployment across vessel fleets. The advisory metadata is available in machine-readable form in the GitHub CSAF JSON File.

Workarounds

Segment FOS-Onboard from ship business networks, crew networks, and any shore-side connectivity that is not required for update operations.
Terminate remote access to the Update Controller through a jump host that enforces multi-factor authentication and session recording.
Disable the deployer-ng Update Controller when it is not actively performing a scheduled deployment, and re-enable it only for the maintenance window.

bash

# Configuration example: restrict Update Controller exposure at the host firewall
# Replace 10.10.20.0/24 with the authorized management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP