Executive Summary: Critical Cryptographic Failures on the High Seas

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent Industrial Control Systems (ICS) advisory, cataloged as ICSA-26-258-02, alerting global maritime operators, cargo fleet managers, and port authorities to multiple maximum-severity vulnerabilities in Wärtsilä FOS-Onboard (Fleet Operations Solution — Onboard). The advisory details two severe cryptographic flaws—tracked as CVE-2026-78225 and CVE-2026-81855—that allow unauthenticated attackers with network access to execute arbitrary commands, deliver malicious updates, and compromise shipboard navigation networks.

Wärtsilä FOS-Onboard is an integrated maritime technology platform deployed across thousands of commercial vessels, including ocean-going container carriers, oil tankers, chemical transport ships, and offshore support vessels. It synchronizes shipboard navigation data, nautical charts, weather routing models, and automated engine optimization telematics between the vessel's bridge and shoreside fleet management centers via satellite links (such as Starlink Maritime, Inmarsat, or VSAT).

The lead vulnerability, CVE-2026-78225, carries a critical CVSS v3.1 base score of 9.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) due to hardcoded cryptographic server keys inside the software's update orchestration service. The secondary flaw, CVE-2026-81855, carries a CVSS score of 9.1 for hardcoded client authentication keys in automated test daemons. If exploited, these flaws expose vessel operational technology (OT) to catastrophic manipulation, threatening navigational safety, hull integrity, and compliance with International Maritime Organization (IMO) resolution MSC.428(98).

Technical Mechanics: Hardcoded Keys in deployer-ng & Automated Frameworks

The architecture of Wärtsilä FOS-Onboard consists of a central shipboard server connected to the vessel's bridge local area network (LAN) and the communication satellite terminal. The platform continuously receives voyage updates, electronic nautical chart (ENC) updates, and automated route recommendations through an orchestration component known as deployer-ng.

1. CVE-2026-78225: The Static Server Key Flaw

Security auditing revealed that deployer-ng relies on hardcoded cryptographic RSA private keys embedded directly within the distributed software binary. Rather than generating a unique, cryptographically secure private key during installation or deriving ephemeral keys via a public key infrastructure (PKI) backed by mutual TLS (mTLS), the application utilizes a static, vendor-compiled private key across every shipboard installation: 

// Decompiled excerpt illustrating static hardcoded key in deployer-ng
const char* kDefaultServerPrivateKey = 
    "-----BEGIN RSA PRIVATE KEY-----\n"
    "MIIEowIBAAKCAQEA0r1f...[STATIC EMBEDDED KEY]...\n"
    "-----END RSA PRIVATE KEY-----";

int InitializeUpdateChannel(UpdateSession* session) {
    // Insecure: Uses static compiled key without verifying ephemeral PKI certificates
    return SSL_CTX_use_PrivateKey_ASN1(EVP_PKEY_RSA, session->ctx, 
                                      kDefaultServerPrivateKey, strlen(kDefaultServerPrivateKey));
}

Because this private key is identical across all installations, an adversary who extracts the key from any single firmware image can forge valid cryptographic update packages or establish authenticated control sessions against any vessel running an affected version. If the ship's satellite router or bridge network exposes the deployer-ng port, an unauthenticated remote adversary can push arbitrary executable payloads directly to the underlying Linux operating system with root privileges.

2. CVE-2026-81855: Hardcoded Client Authentication in Testing Daemons

Compounding the risk, CVE-2026-81855 exists in the robot testing framework integrated into the FOS-Onboard runtime. To facilitate remote diagnostic checks and automated integration testing by shoreside technicians, the daemon incorporates hardcoded client certificates and administrative credentials.

Any attacker who gains access to the ship's business network (crew Wi-Fi, passenger LAN, or compromised shoreside telemetry link) can replay these static credentials to authenticate as a privileged client to the FOS daemon. Once authenticated, the attacker can query live GPS coordinates, alter speed and heading recommendations, extract nautical route waypoints, and disable navigational alarm relays. 

# Threat Trajectory: Shipboard OT Exploitation via Hardcoded Keys
[ Satellite Terminal / VSAT / Crew LAN ]
                 │
                 ▼
[ Maritime Vessel Firewall / Gateway Router ]
                 │ (Exposed Port 8443 / 9000 deployer-ng daemon)
                 ▼
[ Wärtsilä FOS-Onboard Navigation Workstation ]
                 │
                 ├─► [ CVE-2026-78225 Exploit ]: Attacker uses leaked static server key
                 │         ├─ Forges signed firmware update package
                 │         └─ Achieves Unauthenticated Remote Root Code Execution
                 │
                 ├─► [ CVE-2026-81855 Exploit ]: Impersonates privileged test client
                 │         ├─ Injects false waypoint data into route planning engine
                 │         └─ Tampeers with automated speed & fuel consumption logic
                 │
                 ▼
[ Purdue Level 2 / Bridge Control Network ]
                 ├─ Electronic Chart Display and Information System (ECDIS)
                 ├─ Voyage Data Recorder (VDR)
                 └─ Integrated Bridge System (IBS) Engine Telemetry

Maritime Operational Impact & IEC 62443 Boundary Violations

In modern commercial shipping, the boundary between Information Technology (IT) and Operational Technology (OT) is governed by IEC 62443 standards and IMO circulars. The Purdue Model designates shipboard bridge workstations as Level 2 (Supervisory Control) and Level 3 (Site Operations), directly interfacing with Level 1 actuators (engine control units, rudder steering gear, and bow thruster controllers).

The compromise of Wärtsilä FOS-Onboard violates several fundamental IEC 62443-3-3 requirements:

  • SR 1.1 (Human User Identification and Authentication): The presence of hardcoded credentials permits complete bypass of user identity verification.
  • SR 3.1 (Communication Integrity): Static cryptographic keys allow man-in-the-middle (MitM) adversaries to decrypt and manipulate navigational telemetry in transit over satellite links.
  • SR 5.2 (Zone Boundary Protection): Exploiting the FOS server provides an unmonitored bridge across network conduits, connecting satellite communication modems directly into critical bridge subnets.

A sophisticated adversary could alter navigation chart offsets by several hundred meters, suppress collision avoidance alerts, or deliver malicious engine throttle commands during tight coastal pilotage, creating severe environmental, financial, and life-safety catastrophes.

Defensive Playbook: Maritime Engineering & Security Checklist

Vessel superintendents, marine IT officers, and shoreside security operation centers (SOCs) must execute the following immediate actions:

1. Apply Vendor Firmware Update

Wärtsilä has released FOS-Onboard version 5.07.0923.01, which replaces the hardcoded cryptographic keys with dynamic, PKI-backed certificate exchange and removes static diagnostic credentials. Contact Wärtsilä Marine Support immediately to schedule firmware deployment during the next port call or authorized maintenance window.

2. Implement Strict Network Conduit Filtering (IEC 62443-3-2)

Vessel firewalls must be immediately audited to ensure that shipboard FOS-Onboard management interfaces are never exposed to the public Internet, crew networks, or unencrypted satellite transit: 

# Example pfSense / iptables hardening rules for shipboard satellite gateway:
# 1. Block all unsolicited inbound traffic from satellite WAN to FOS workstation
iptables -A FORWARD -i wan_sat -d 192.168.10.50 -p tcp --dport 8443 -j DROP
iptables -A FORWARD -i wan_sat -d 192.168.10.50 -p tcp --dport 9000 -j DROP

# 2. Restrict FOS Update Controller access strictly to authorized shoreside VPN tunnel
iptables -A FORWARD -i tun0 -s 10.200.0.0/16 -d 192.168.10.50 -p tcp --dport 8443 -j ACCEPT

# 3. Prevent Crew Wi-Fi / Passenger VLAN from routing to Bridge OT VLAN
iptables -A FORWARD -i vlan_crew -d 192.168.10.0/24 -j DROP
iptables -A FORWARD -i vlan_crew -d 192.168.20.0/24 -j DROP

3. Technical Vulnerability Comparison Table

Security Metric CVE-2026-78225 CVE-2026-81855
Vulnerability Class CWE-798 (Use of Hard-coded Credentials) CWE-798 (Hard-coded Client Certificate)
CVSS v3.1 Score 9.5 (Critical) 9.1 (Critical)
Attack Vector Network (Satellite WAN / Bridge LAN) Network (Vessel Local Network)
Impacted Component deployer-ng Update Controller Robot Automated Testing Framework
Exploitation Outcome Unauthenticated Remote Root Code Execution Privileged Client Impersonation & Route Tampering
Remediation Build FOS-Onboard v5.07.0923.01 or later FOS-Onboard v5.07.0923.01 or later

Actionable Checklist for Marine IT & Bridge Crews

  • Inventory Bridge Software: Confirm the currently installed version of FOS-Onboard across all vessel terminals in the fleet.
  • Isolate Satellite Modems: Ensure the satellite terminal (VSAT / Starlink) connects to a dedicated maritime DMZ router with stateful packet inspection rather than plugging directly into bridge network switches.
  • Review IMO Resolution Compliance: Document vulnerability mitigations and update deployment records in the vessel's Safety Management System (SMS) to maintain maritime cyber compliance during port state inspections.
  • Audit Voyage Planning Logs: Inspect Electronic Chart Display and Information System (ECDIS) waypoint history and FOS-Onboard telemetry logs for unauthorized configuration alterations or anomalous connection attempts.