Furuno FA-50 EUVD-2026-65319

Exploitation requires two specific, cumulative conditions: first, knowledge of the hard-coded credentials embedded in all FA-50 firmware versions - these credentials are static and identical across every unit, making them discoverable through firmware reverse engineering, vendor communications, or coordinated disclosure artifacts; and second, network-level access to the vessel's internal network, meaning the attacker must be physically present aboard the vessel or must have compromised another device that is already connected to the shipboard LAN. Exploitation is not feasible from the open internet without a prior lateral-movement foothold. Limiting factors include the physical-proximity constraint of vessel network access, the relatively small pool of insiders with legitimate shipboard access, and the requirement that the attacker have obtained the specific hard-coded credential string prior to the attack.

The official CVSS 4.0 score of 8.8 uses AV:N (network-reachable), but the CVE description explicitly requires 'access to the vessel's internal network,' which more accurately corresponds to AV:A (adjacent network). This discrepancy is material: real-world exploitation is bounded to shipboard networks and is not feasible from the open internet, substantially reducing the attacker population compared to what AV:N implies. No EPSS score is provided, and the vulnerability does not appear in CISA KEV, suggesting no confirmed active exploitation at time of analysis. The integrity and availability impacts are genuinely high - altering an AIS identification number carries regulatory and safety consequences under IMO conventions - but the combined prerequisites (physical or network proximity to the vessel plus knowledge of the hard-coded credential) constrain realistic risk to insider threats, compromised shipboard devices, or attackers with pre-existing vessel network access. The absence of a confidentiality impact (VC:N) is consistent with the description, which describes only a write-access function.

An attacker with physical access to the vessel - such as an unauthorized crew member, a port technician, or someone who has already compromised another shipboard network device - scans the vessel's internal network to identify the FA-50's IP address. Using the hard-coded credentials that are uniform across all FA-50 units and obtainable through firmware analysis or advisory disclosure, the attacker authenticates to the settings interface and overwrites the vessel's identification number, causing the vessel to broadcast a false MMSI that could match another vessel or render the transponder's output non-compliant with IMO regulations. No public exploit code has been identified at time of analysis.