FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters.

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters.

An attacker, who knows the credentials and has access to the in-vessel network to which the device is connected to, may operate the settings screen using that credentials to alter the settings of the device. Some configurations may be changed on the management screen without authentication.

FA-50 CLASS B AIS TRANSPONDER provided by FURUNO ELECTRIC CO., LTD. contains the following vulnerabilities.<a href='https://cwe.mitre.org/data/definitions/798.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/306.html' target='_blank'></a><ul><li>Use of hard-coded credentials (CWE-798) - CVE-2026-59769</li><ul><li>The CVSS evaluation above assumes that an attacker who knows the credentials and has access to the network to which the device is connected to operates, using that credentials, the settings screen and alter the identification number etc.</li></ul><li>Missing authentication for critical function (CWE-306) - CVE-2026-67578</li></ul>Souvik Kandar reported these issues to CISA ICS. At the request of the developer and CISA ICS, JPCERT/CC coordinated with the developer.