Hardcoded crypto keys found in Wärtsilä FOS-Onboard
Two critical CVEs in the vessel control system expose operators to unauthorized updates and credential theft, with a patch gated behind a vendor contact form.
TL;DR
CISA published two critical advisories for Wärtsilä FOS-Onboard version 5.07.0923.01: CVE-2026-78225 (CVSS 9.0) and CVE-2026-81855 (CVSS 9.1), both involving hardcoded cryptographic keys. The deployer-ng Update Controller carries a server key baked into the binary; the robot testing framework ships a client authentication key. An attacker who can reach the vessel's network can deliver unauthorized updates, execute code, or extract credentials to impersonate a privileged client. Wärtsilä says the flaws aren't exploitable when the product is "installed as recommended" and has developed a patch, but operators must contact the vendor directly to obtain it.
The two CVEs land within the same product and version, but target different components. CVE-2026-78225 sits in the deployer-ng Update Controller and uses a hardcoded server key, CVSS 9.0 (v3.1), network attack vector, high attack complexity, scope-changed. CVE-2026-81855 sits in the robot testing framework with a hardcoded client authentication key, CVSS 9.1 (v3.1), network attack vector, low attack complexity, no scope change. Together they cover the update pipeline and the authentication layer.
Cydome Security Ltd reported both to Wärtsilä and CISA. Deployment is worldwide under the Transportation Systems critical infrastructure sector. Wärtsilä is headquartered in Finland.
The vendor's mitigation stance warrants attention. Wärtsilä asserts the vulnerabilities "are not exploitable when the product is installed as recommended", a formulation that places the burden on the operator's network architecture rather than the shipped binary. The patch exists but there's no public download link or over-the-air push. Operators are directed to a contact form at Wärtsilä's ICS patch deployment page. For vessel operators running FOS-Onboard 5.07.0923.01, the remediation path is: pick up the phone, request the patch, schedule a maintenance window. That's a timeline measured in port calls, not hours.
This isn't a zero-day. No known public exploitation has been reported to CISA. But hardcoded cryptographic material in OT products (especially those deployed on vessels with intermittent connectivity) means the window between advisory publication and fleet-wide patching will stretch. The CVSS 4.0 scores (9.5 and 9.3) reflect the reality: if an attacker reaches the network, the keys are already in the firmware.
Published ·Deep Fathom