CVE-2026-78225

Wärtsilä FOS-Onboard, a maritime fleet operations software suite deployed onboard vessels, contains a hardcoded cryptographic server key (CWE-321) in its deployer-ng Update Controller component. Because the key is embedded in the shipped software, anyone with access to the product binaries could extract it and then impersonate the legitimate update server or forge/tamper with update communications against exposed installations over the network, with no privileges or user interaction required. Successful abuse could allow an attacker to push manipulated updates or otherwise compromise the onboard system, with the CVSS 4.0 vector (9.5, all impact dimensions high, including safety) indicating severe consequences for vessel system confidentiality, integrity, availability, and safety. Vessel operators running FOS-Onboard with the deployer-ng Update Controller reachable from ship or shore networks are affected. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild is known at this time.

What to do: Apply the vendor fix per the Wärtsilä and CISA ICS advisory and replace/rotate the hardcoded key, since the shipped key must be treated as compromised. Until patched, restrict network reachability of the deployer-ng Update Controller by segmenting onboard OT networks, firewalling the update path, and limiting update services to trusted shore-side endpoints. Monitor update traffic and controller logs for anomalous or unsigned update attempts, and verify with Wärtsilä exactly which FOS-Onboard versions are vulnerable and which version remediates the issue.