Which versions of Furuno FA-50 are affected by CVE-2026-67578?

The Furuno FA-50 maritime device (all versions) contains an unauthenticated configuration manipulation vulnerability (CVSS 8.7) that allows unauthorized modification of device settings from the…

How to fix or mitigate CVE-2026-67578?

Within 24 hours: Identify and inventory all Furuno FA-50 devices across the fleet and document their network locations. Immediately implement network segmentation and firewall rules to restrict internal network access to the device's configuration interface to only authorized personnel and systems. Within 7 days: Deploy continuous monitoring and alerting on the device configuration interface to detect unauthorized changes; establish baseline configurations for all Furuno FA-50 devices and configure automated alerts for deviations from baseline. Enforce authentication and access controls at the network boundary where access to vessel networks is controlled. Within 30 days: Contact Furuno for a security update timeline and inquire about interim recommendations; evaluate the criticality and replacement feasibility of all identified devices; document and test manual configuration audit procedures as part of regular maritime operational security reviews.

Furuno FA-50 CVE-2026-67578

Q: What is the CVSS score of CVE-2026-67578?

CVE-2026-67578 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-65318 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-25 jpcert

GHSA-g4fq-7hvq-hm4q

Authentication Bypass Fa 50

8.7

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Internal vessel network requirement makes AV:A more accurate than AV:N; no authentication needed (PR:N); only configuration integrity impact is described, so C:N and A:N.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 25, 2026 - 08:36 vuln.today

CVSS changed

Aug 25, 2026 - 08:22 NVD

7.5 (HIGH) 8.7 (HIGH)

CVE Published

Aug 25, 2026 - 07:42 cve.org

HIGH 8.7

DescriptionCVE.org

FA-50 all versions miss authentication for some configuration. An attacker with access to the vessel's internal network can manipulate the product's settings screen to alter some configuration parameters.

AnalysisAI

Configuration manipulation in the Furuno FA-50 maritime device (all versions) is possible without authentication from the vessel's internal network. The product fails to enforce access controls on its settings interface (CWE-306), allowing any attacker who gains internal network access to alter device configuration parameters. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires network connectivity to the vessel's internal LAN where the FA-50 is deployed - the attacker cannot exploit this remotely over the public internet without first traversing the vessel's network perimeter. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 8.7 reflects a network-accessible (AV:N), low-complexity, no-authentication-required exploit path with high integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Consult the Furuno vendor advisory at https://www.furuno.co.jp/en/news/notice/notice_category.html?itemid=1857&dispmid=965 for firmware update guidance; no specific fixed version number was provided in the available intelligence data, so patch availability and exact update version must be confirmed directly with Furuno Electric. … Detailed patch versions, workarounds, and compensating controls in full report.