Furuno FA-50 CVE-2026-67578

Exploitation requires network connectivity to the vessel's internal LAN where the FA-50 is deployed - the attacker cannot exploit this remotely over the public internet without first traversing the vessel's network perimeter. Once on the internal network, no authentication is required (CWE-306; PR:N per the CVSS 4.0 vector), and no specific optional feature or non-default configuration flag must be enabled - the unauthenticated settings interface appears to be present in the default state across all versions. Limiting factors include: the physical and logical boundary of the vessel network, which typically requires physical ship access, compromise of crew connectivity infrastructure (Wi-Fi, satellite uplink), or insider access; no user interaction from a legitimate operator is required to complete the attack. The impact is limited to configuration integrity (VI:H) - no confidentiality or availability impact is indicated by the CVSS 4.0 vector (VC:N, VA:N).

The CVSS 4.0 score of 8.7 reflects a network-accessible (AV:N), low-complexity, no-authentication-required exploit path with high integrity impact. However, the description explicitly constrains exploitation to 'the vessel's internal network,' which is a meaningful boundary: the attacker must already hold a foothold on the ship's LAN, limiting opportunistic internet-based attacks. The provided CVSS 4.0 AV:N designation may overstate real-world reach; AV:A (Adjacent) would more precisely reflect this internal-network requirement and is how this analysis independently assesses the vector. No EPSS data was provided in the source intelligence, and the absence from CISA KEV combined with no identified public POC indicates no confirmed active exploitation at this time. For maritime operators, the risk is nonetheless significant: vessel networks frequently lack robust internal segmentation, and unauthorized modification of navigation or communication configuration could carry safety-of-life implications well beyond typical IT/enterprise impact assessments.

An attacker who has gained access to a vessel's internal network - through a compromised crew device, an unsecured Wi-Fi segment, or physical access to a network port - can navigate directly to the FA-50's web-based configuration interface without supplying any credentials. Once on the settings screen, the attacker can silently modify configuration parameters, potentially altering navigation or communication device behavior without crew awareness. No public exploit code has been identified at time of analysis, and the attack requires no special tooling beyond a web browser and network connectivity to the device.