Fa 50
Monthly
Hard-coded credentials in all versions of the Furuno FA-50 maritime AIS transponder allow any attacker with knowledge of the static credentials and access to the vessel's internal network to authenticate to the device's settings screen and alter the vessel's identification number. Modification of the AIS identification number (MMSI) carries serious maritime safety implications, enabling vessel impersonation or disruption of AIS-based collision avoidance and vessel tracking systems. Disclosed via JPCERT coordination and JVN advisory JVNVU95422936; no public exploit has been identified at time of analysis.
Configuration manipulation in the Furuno FA-50 maritime device (all versions) is possible without authentication from the vessel's internal network. The product fails to enforce access controls on its settings interface (CWE-306), allowing any attacker who gains internal network access to alter device configuration parameters. No public exploit code has been identified at time of analysis, and the device is not listed in CISA KEV, but the unauthenticated network-accessible vector and high integrity impact (CVSS 4.0: 8.7, VI:H) make this a meaningful risk in maritime operational environments.
Hard-coded credentials in all versions of the Furuno FA-50 maritime AIS transponder allow any attacker with knowledge of the static credentials and access to the vessel's internal network to authenticate to the device's settings screen and alter the vessel's identification number. Modification of the AIS identification number (MMSI) carries serious maritime safety implications, enabling vessel impersonation or disruption of AIS-based collision avoidance and vessel tracking systems. Disclosed via JPCERT coordination and JVN advisory JVNVU95422936; no public exploit has been identified at time of analysis.
Configuration manipulation in the Furuno FA-50 maritime device (all versions) is possible without authentication from the vessel's internal network. The product fails to enforce access controls on its settings interface (CWE-306), allowing any attacker who gains internal network access to alter device configuration parameters. No public exploit code has been identified at time of analysis, and the device is not listed in CISA KEV, but the unauthenticated network-accessible vector and high integrity impact (CVSS 4.0: 8.7, VI:H) make this a meaningful risk in maritime operational environments.