External risk intelligence

Wärtsilä FOS-Onboard Update Controller Hardcoded Key Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-78225

The affected component is an onboard update controller within a marine fleet operations system. Such systems are typically deployed on maritime vessels and managed within isolated operational technology networks, making public internet exposure uncommon despite the network-based nature of the vulnerability.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Wärtsilä FOS-Onboard system's deployer-ng Update Controller, involving a hardcoded cryptographic key. This type of issue could potentially allow unauthorized access or manipulation if exploited. The primary concern is to confirm if this specific technology is in use and assess any associated exposure.

Hardcoded key in update controller.
Confirms operational technology relevance.
Assess system usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage the hardcoded server key in the deployer-ng Update Controller to gain access to the Wärtsilä FOS-Onboard system. This vulnerability could allow an attacker to compromise the integrity and confidentiality of the system.

No authentication required.
Updates to the system can be intercepted.
Confidentiality, integrity, and availability risks.

Live Threat

Current exploitation, exposure, and threat context

A hardcoded cryptographic key in the Update Controller could allow an attacker to compromise the integrity and confidentiality of system data and service behavior. This risk exists when the affected component is accessible and the key is exposed.

System data and service integrity.
When the component is accessible and key is exposed.
Confidentiality and integrity of system operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Wärtsilä FOS-Onboard Update Controller is likely managed by the fleet operations or IT infrastructure teams responsible for onboard systems. The first practical step is to identify all deployed instances of this component, confirm their network accessibility and criticality to operations, and then locate the accountable owner for remediation planning.

Own the issue: Fleet operations or IT infrastructure teams.
Verify first: Identify and confirm all deployments and exposure.
Action: Plan remediation based on operational risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the role of Wärtsilä FOS-Onboard in maritime operations?

Wärtsilä FOS-Onboard is a fleet operations system designed to support maritime vessels. As an onboard management platform, it facilitates critical data processing and operational monitoring within specialized maritime environments, functioning as the host for components like the deployer-ng Update Controller.

What does CWE-321 signify for CVE-2026-78225?

CWE-321, or Use of a Hard-coded Cryptographic Key, identifies that the deployer-ng Update Controller utilizes a fixed, embedded secret for security operations. This weakness prevents the use of unique or dynamic keys, which could compromise the integrity of communications or the authenticity of system updates.

How does the deployer-ng component trigger this vulnerability?

The vulnerability is triggered when the update controller, containing the hardcoded key, is accessible over a network. While the issue exists in the software design, the scope is typically limited to isolated operational technology networks rather than public-facing systems, restricting direct external exploitation paths.

Is this vulnerability likely to be encountered in my environment?

According to the Halo Surface Signal, this vulnerability is considered 'Unlikely' to be exposed. Because Wärtsilä FOS-Onboard typically operates within isolated maritime operational technology networks, direct public internet access to the deployer-ng Update Controller is not standard practice.

How should an organization respond to this update controller risk?

Organizations should first perform an inventory to locate all deployed instances of the Wärtsilä FOS-Onboard system. Once identified, teams should verify network accessibility and collaborate with fleet operations or IT infrastructure owners to plan remediation and mitigate potential exposure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.