Wärtsilä FOS-Onboard

CISA issued an advisory for Wärtsilä FOS-Onboard version 5.07.0923.01, disclosing two critical vulnerabilities (CVE-2026-78225 and CVE-2026-81855) involving hard-coded cryptographic keys (CWE-321). CVE-2026-78225 affects the deployer-ng Update Controller component with a hardcoded server key, while CVE-2026-81855 affects the robot testing framework with a hardcoded client authentication key. Both vulnerabilities carry CRITICAL CVSS scores (9.0 and 9.1 respectively for CVSS 3.1). Successful exploitation could allow attackers to deliver unauthorized updates, execute code, or extract credentials to impersonate privileged clients. The affected product is deployed worldwide in the Transportation Systems critical infrastructure sector, with Wärtsilä headquartered in Finland. Wärtsilä states vulnerabilities are not exploitable when installed as recommended and has developed a security patch available via direct contact. The vulnerabilities were reported by Cydome Security Ltd. No known public exploitation has been reported at the time of publication.