FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, can operate the settings screen using that credentials to alter the identification number.

FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, can operate the settings screen using that credentials to alter the identification number.

An attacker, who knows the credentials and has access to the in-vessel network to which the device is connected to, may operate the settings screen using that credentials to alter the settings of the device. Some configurations may be changed on the management screen without authentication.

FA-50 CLASS B AIS TRANSPONDER provided by FURUNO ELECTRIC CO., LTD. contains the following vulnerabilities.<a href='https://cwe.mitre.org/data/definitions/798.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/306.html' target='_blank'></a><ul><li>Use of hard-coded credentials (CWE-798) - CVE-2026-59769</li><ul><li>The CVSS evaluation above assumes that an attacker who knows the credentials and has access to the network to which the device is connected to operates, using that credentials, the settings screen and alter the identification number etc.</li></ul><li>Missing authentication for critical function (CWE-306) - CVE-2026-67578</li></ul>Souvik Kandar reported these issues to CISA ICS. At the request of the developer and CISA ICS, JPCERT/CC coordinated with the developer.