EUVD-2026-80010
GHSA-xr64-qq65-vf4r
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable pre-auth (PR:N) but AC:H for the key-abuse/MITM effort; hardcoded key undermines the update-controller trust anchor affecting downstream systems, justifying S:C and full CIA impact.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
2DescriptionCVE.org
A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.
AnalysisAI
Hardcoded cryptographic server key exposure in the deployer-ng Update Controller of Wärtsilä FOS-Onboard build 5.07.0923.01 lets remote attackers who recover the embedded static key impersonate the legitimate update server or decrypt and forge update traffic, yielding high confidentiality, integrity, and availability impact with scope change (assessed CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; vendor/ENISA scoring 9.5). No authentication or user interaction is required, but exploitation is conditioned on the Update Controller being network-reachable and on the attacker obtaining the hardcoded key - a step that implies either direct access to the software/firmware image or a suitable man-in-the-middle position on the update channel - which, combined with the typically air-gapped nature of vessel OT networks, keeps real-world urgency below the raw score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the deployer-ng Update Controller component of Wärtsilä FOS-Onboard (affected build 5.07.0923.01) to be network-reachable, and the attacker must obtain the static hardcoded cryptographic server key (recoverable from the software/firmware because it is embedded, CWE-321) to impersonate the server or decrypt/forge its update traffic. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-severity issue but its real-world urgency is tempered by exposure and complexity factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact fixed build number is identified in the available data; the vendor's ICS patch-deployment channel referenced in the CISA advisory indicates that remediation for FOS-Onboard is delivered through direct engagement with Wärtsilä (https://www.wartsila.com/services-catalogue/engine-services-4-stroke/wartsila-ics-patch-deployment#contact), so the first action is to open a case with Wärtsilä ICS support, cite CVE-2026-78225 / ICSA-26-258-02, and obtain the corrected deployer-ng Update Controller build that replaces the embedded static key with device-unique credentials - vendor-released patch: consult Wärtsilä ICS patch deployment per advisory ICSA-26-258-02. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
No vendor-released patch identified at time of analysis. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today