CVE-2026-78225

Deferred Deferred - Pending Action

Hard-Coded Cryptographic Key in Wärtsilä FOS-Onboard

Publication date: 2026-09-15

Last updated on: 2026-09-24

Assigner: ICS-CERT

Description

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-24

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-78225

EUVD

EUVD-2026-80010

Affected Vendors & Products

Vendor	Product	Version / Range
wärtsilä	fos-onboard	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability involves a hardcoded cryptographic server key in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard. Hardcoded keys can allow attackers to bypass authentication or decrypt sensitive data if they gain access to the system.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the system, decrypt communications, or manipulate update processes. This could lead to data breaches, system compromise, or operational disruptions in maritime environments using Wärtsilä FOS-Onboard.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, fines, or reputational damage due to potential data exposure.

Mitigation Strategies

Immediately update the deployer-ng Update Controller component to the latest patched version to remove the hardcoded cryptographic server key. Restrict network access to the component and audit all configurations for exposed keys or credentials.

Hi! I’m here to help you understand CVE-2026-78225. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70