Vulnerabilities in FURUNO FA-50 Class B AIS Transponders

Source context: this article examines information published by the source on August 25, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.

What the vulnerability is

Two vulnerabilities have been identified in the FURUNO FA-50 Class B AIS Transponder that could allow an attacker to alter device settings.

• CVE-2026-59769: This involves the use of hard-coded credentials. An attacker with access to the in-vessel network and knowledge of these credentials could operate the settings screen to modify device configurations.
• CVE-2026-67578: This is a missing authentication vulnerability where certain configurations on the management screen may be changed without any authentication required.

Exposure and applicability

These vulnerabilities affect all versions of the FURUNO FA-50 Class B AIS Transponder. The device is used in maritime transportation systems for vessel tracking and safety.

Exposure occurs if an attacker gains access to the management screen or the internal vessel network to which the transponder is connected. There are no reported instances of public exploitation of these vulnerabilities at this time.

Remediation priorities

Because production of the FA-50 ended in October 2020, the manufacturer has stated that software updates will no longer be provided. Consequently, remediation focuses on reducing the attack surface through environmental controls rather than patching.

Our analysis suggests the following prioritized actions for vessel operators and fleet managers:

1. Network Isolation: Ensure the FA-50 is not connected directly to the internet. This prevents remote attackers from reaching the management interface via external networks.
2. Vessel Access Control: Implement strict physical security protocols to ensure the vessel and its bridge equipment are locked and managed, reducing the risk of unauthorized local network access.
3. Network Segmentation: For operators with integrated shipboard networks, we recommend isolating the AIS transponder from other non-essential systems using firewalls or VLANs to limit lateral movement if another onboard system is compromised.

How to validate remediation

Since no firmware update exists to resolve these flaws, validation must focus on the effectiveness of the compensating controls:

• Connectivity Audit: Verify through network configuration reviews that there is no direct routing path from the public internet to the FA-50 management interface.
• Physical Inspection: Confirm that access to the device and its network ports is restricted to authorized personnel only via physical locks or secure enclosures.
• Segmentation Testing: In a non-production environment or during scheduled maintenance, verify that devices on separate vessel networks cannot communicate with the FA-50 management screen.

Limits and open questions

These measures are designed to reduce the likelihood of exploitation but do not remove the underlying vulnerabilities. The use of hard-coded credentials (CVE-2026-59769) remains a residual risk for any actor who successfully gains access to the internal vessel network.

Asset owners should be aware that because the product is end-of-life, no future security updates will be released. This creates a permanent vulnerability state for the hardware, necessitating a long-term evaluation of equipment replacement cycles for affected vessels.

Source and editorial note

FURUNO FA-50 Class B AIS Transponder · Source date: August 25, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request an OT security assessment