CISA flags two flaws in Furuno AIS transponder, says no updates are planned
CISA warned that two vulnerabilities in the FURUNO FA-50 Class B AIS Transponder could allow unauthorized changes to device settings. The agency said the product is no longer being updated because production ended in October 2020.
CISA on Aug. 25 published an advisory on two vulnerabilities in the FURUNO FA-50 Class B AIS Transponder, saying the flaws could let an unauthorized user change device settings. The agency said the affected product is made by FURUNO ELECTRIC CO., LTD., all versions are affected, and software updates will no longer be provided because production ended in October 2020.
CISA said the transponder is used worldwide in the Transportation Systems sector. It said the issues could let an attacker alter settings on the device, which could affect shipboard communications equipment if the product is exposed to the wrong network or is physically accessible without proper controls.
CISA identified one flaw as CVE-2026-59769, which it said involves hard-coded credentials. According to the advisory, an attacker who knows those credentials and has access to the in-vessel network could operate the settings screen and change device settings. CISA linked that issue to CWE-798, or use of hard-coded credentials, and assigned it a CVSS v3.1 base score of 9.1, which it classed as critical.
The second issue, CVE-2026-67578, allows some configurations to be changed on the management screen without authentication, CISA said. The advisory linked that flaw to CWE-306, missing authentication for a critical function, and assigned it a CVSS v3.1 base score of 7.5, which it rated high.
CISA said the product status is known affected. It also said no known public exploitation specifically targeting these vulnerabilities has been reported to the agency at this time.
In its mitigation guidance, the advisory says not to connect the product directly to the internet. It also says the vessel should be properly locked and managed to prevent unauthorized access. The advisory lists the vendor’s headquarters in Japan and says the product is deployed worldwide.
CISA credited Souvik Kandar with reporting the vulnerabilities and said JPCERT/CC coordinated with Furuno Electric and CISA.
With production ended and no software updates planned, the advisory says configuration and access controls are the main defenses for users.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()