Critical severity · published Aug 25, 2026
CVE-2026-59769
FA-50 all versions contain hard-coded credentials
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
FA-50 all versions contain hard-coded credentials.
An attacker, who knows the credentials and has access to the vessel's internal network, can operate the settings screen using that credentials to alter the identification number.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
FA-50 · FURUNO ELECTRIC CO., LTD.
All versions, or not specified · source: vendor
In the news
VulnerabilityCritical
FURUNO FA-50 Class B AIS Transponder
View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker to alter device settings.
The following versions of FURUNO FA-50 Class B AIS Transponder are affected:
FURUNO FA-50 Class B AIS Transponder vers:all/*
CVSS
Vendor
Equipment
Vulnerabilities
v3 9.1
FURUNO ELECTRIC CO.,LTD.
FURUNO FA-50 Class B AIS Transponder
Use of Hard-coded Credentials, Missing Authentication for Critical Function
Background
Critical Infrastructure Sectors: Transportation Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Japan
Vulnerabilities
Expand All +
CVE-2026-59769
An attacker, who knows the credentials and has access to the in-vessel network to which the device is connected to, may operate the settings screen using that credentials to alter the settings of the device.
View CVE Details
Affected Products
FURUNO FA-50 Class B AIS Transponder
Vendor: FURUNO ELECTRIC CO.,LTD.
Product Version: FURUNO FA-50 Class B AIS Transponder: vers:all/*
Product Status: known_affected
Remediations
Mitigation FURUNO ELECTRIC CO.,LTD. notes that production of this product ended in October 2020, and software updates will no longer be provided. FURUNO recommends users do not connect the product directly to the internet. To prevent unauthorized access, the vessel on which the product is installed should be properly locked and managed.
...
Aug 25, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59769
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59769
jvn.jp
https://jvn.jp/en/vu/JVNVU95422936/
www.furuno.co.jp
https://www.furuno.co.jp/en/news/notice/notice_category.html?itemid=1857&dispmid=965
www.furuno.co.jp
https://www.furuno.co.jp/news/notice/notice_category.html?itemid=1856&dispmid=1039
More from FA-50
7.5
CVE-2026-67578
FA-50 all versions miss authentication for some configuration
