FA-50 all versions contain hard-coded credentials.

CVE-2026-59769 affects all versions of the FURUNO ELECTRIC FA-50, a Class B AIS (Automatic Identification System) transponder installed on commercial and recreational vessels. The device ships with hard-coded credentials (CWE-798) that cannot be changed by the operator. An attacker who knows these credentials and has network access to the vessel's internal LAN can authenticate to the FA-50's built-in web server and modify the vessel's MMSI (Maritime Mobile Service Identity) number — the unique identifier broadcast to other ships, coast guard stations, and collision-avoidance systems. Because the FA-50 includes an Ethernet port and self-contained web interface, no special tooling is needed beyond a browser once on the LAN.

The vendor's CRITICAL 9.1 score is mechanically correct under CVSS 3.1 — the vector is AV:N/AC:L/PR:N/UI:N — but it overstates real-world risk for enterprise-adjacent and maritime fleet defenders. The 'network' in question is the vessel's isolated shipboard LAN, *not* the public internet. Reaching that LAN requires physical presence aboard the vessel or prior compromise of the VSAT/satellite gateway bridging the vessel to shore networks. The CVSS score treats any Ethernet-reachable device the same as a public-facing web server, which inflates the perceived risk. That said, the safety implications of MMSI spoofing on a live vessel — disrupting collision avoidance and coast guard tracking — prevent this from being merely MEDIUM.

Why this verdict

• Network isolation friction: The CVSS vector scores AV:N but the relevant network is a vessel's bridge LAN, not the internet. Reaching this network requires physical boarding or prior compromise of a VSAT gateway — each a significant barrier that compounds downward pressure from 9.1.
• Role multiplier (OT/maritime safety): The FA-50 is canonically an OT/ICS device — an AIS transponder is part of maritime collision avoidance infrastructure. Successful MMSI modification on a live vessel has a safety-tier blast radius (vessel misidentification → potential collision risk, evasion of coast guard tracking). This floors the verdict at HIGH despite the access friction.
• No patch available: All versions are affected with no firmware fix confirmed. Hard-coded credentials in embedded firmware are notoriously difficult to remediate — this is effectively a design flaw that may require hardware replacement, extending exposure duration indefinitely.
• Universal credentials: The hard-coded credentials are identical across all FA-50 units. Once extracted by any researcher or attacker, they work on every unit globally — no per-device secrets exist. This is a classic embedded-device antipattern that maximizes the value of credential disclosure.

Why not higher?

CRITICAL would require either active exploitation (not observed, not KEV-listed, EPSS is bottom-3rd-percentile) or internet-facing attack surface enabling mass exploitation. The FA-50 sits on a vessel's isolated LAN with no default internet exposure. The blast radius is per-vessel, not fleet-scale — compromising one FA-50 does not pivot to other vessels or shore infrastructure. The safety impact, while real, requires physical or near-physical proximity to exploit.

Why not lower?

MEDIUM would undercount the OT/safety implications. This is a maritime navigation safety device where identity spoofing has direct physical-world consequences — disrupted collision avoidance, regulatory evasion, potential for facilitating illegal activity (sanctions evasion, IUU fishing). The credentials are universal and unchangeable, meaning the entire installed base is permanently vulnerable once credentials leak. The companion CVE-2026-67578 (missing auth) suggests additional attack surface on the same device.

1. Isolate FA-50 on a dedicated bridge-equipment VLAN with no routing to crew networks or VSAT uplinks — The primary attack vector requires LAN access. Segmenting the FA-50 onto a dedicated navigation-equipment VLAN with ACLs blocking all non-essential traffic eliminates the most practical remote path. Deploy within the noisgate mitigation SLA of 30 days for HIGH severity.
2. Disable or restrict HTTP access to the FA-50 web interface — If vessel operations do not require ongoing web-based configuration, block TCP port 80/443 to the FA-50 IP at the switch or firewall level. This prevents credential-based login even from the local LAN. Coordinate with bridge officers to ensure AIS data output (NMEA 0183/Ethernet) remains functional.
3. Monitor AIS broadcast for MMSI anomalies — Configure shore-side fleet management or VTS integration to alert on unexpected MMSI changes for your vessels. Services like MarineTraffic offer fleet tracking APIs that can detect identity changes. This is a detective control, not preventive, but provides rapid awareness.
4. Engage Furuno for firmware update timeline — Contact your Furuno sales or support representative to request a firmware update roadmap. Document the inquiry for compliance purposes. If no update is forthcoming within 180 days (noisgate remediation SLA), evaluate replacement with a transponder from a vendor that supports credential rotation.

Run this script from any workstation with HTTP access to the FA-50's IP address on the vessel LAN. Invoke with: python3 check_fa50_hardcoded.py <FA50_IP>. No elevated privileges required — it simply attempts an HTTP connection to the web interface and checks for indicators of the hard-coded credential vulnerability.

#!/usr/bin/env python3
"""Check FURUNO FA-50 AIS Transponder for CVE-2026-59769 (hard-coded credentials).
Usage: python3 check_fa50_hardcoded.py <FA50_IP>
Outputs: VULNERABLE / PATCHED / UNKNOWN
Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN
"""
import sys
import urllib.request
import urllib.error
import ssl

def main():
    if len(sys.argv) != 2:
        print("Usage: python3 check_fa50_hardcoded.py <FA50_IP>")
        sys.exit(2)
    host = sys.argv[1]
    url = f"http://{host}/"
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    try:
        req = urllib.request.Request(url, method="GET")
        req.add_header("User-Agent", "noisgate-cve-check/1.0")
        resp = urllib.request.urlopen(req, timeout=10)
        body = resp.read().decode("utf-8", errors="replace").lower()
        # Check if this is a Furuno FA-50 web interface
        if "furuno" in body or "fa-50" in body or "fa50" in body or "ais" in body:
            # FA-50 web interface is accessible — all versions are vulnerable
            # since no patch exists. If we can reach the web UI, it is exploitable.
            print("VULNERABLE — FURUNO FA-50 web interface detected.")
            print(f"  Host: {host}")
            print("  CVE-2026-59769: All FA-50 firmware versions contain hard-coded credentials.")
            print("  No patch is available. Apply network segmentation controls.")
            sys.exit(0)
        else:
            print(f"UNKNOWN — HTTP response from {host} does not match FA-50 signatures.")
            print("  Verify manually that this is a FURUNO FA-50 device.")
            sys.exit(2)
    except urllib.error.HTTPError as e:
        print(f"UNKNOWN — HTTP error {e.code} from {host}. Device may be FA-50 but web UI is restricted.")
        sys.exit(2)
    except urllib.error.URLError as e:
        print(f"UNKNOWN — Cannot reach {host}: {e.reason}")
        print("  Ensure you are on the vessel LAN with connectivity to the FA-50.")
        sys.exit(2)
    except Exception as e:
        print(f"UNKNOWN — Unexpected error: {e}")
        sys.exit(2)

if __name__ == "__main__":
    main()

Sources

1. OffSeq Threat Radar — CVE-2026-59769
2. OffSeq Threat Radar — CVE-2026-67578 (related FA-50 vuln)
3. Furuno FA-50 Product Brochure (PDF)
4. Furuno USA — FA-50 Product Page
5. MITRE ATT&CK ICS — T1694.002 Hardcoded Credentials
6. CISA Known Exploited Vulnerabilities Catalog
7. SmartTech247 — ICS Vulnerabilities August 2026