Security1 publisher2 min readPublished
Hardcoded server key lets an attacker push updates to Wärtsilä FOS-Onboard installations
CISA published the advisory on September 15 covering FOS-Onboard 5.07.0923.01. Wärtsilä has built a patch, but users have to contact the company to get it, so the schedule sits with fleet service.
The Watch · Security desk
What happened
- CISA published advisory ICSA-26-258-02 on September 15, 2026, naming Wärtsilä FOS-Onboard 5.07.0923.01 as affected by CVE-2026-78225 and CVE-2026-81855.
- One flaw is a hardcoded cryptographic server key in the deployer-ng Update Controller component; the other is a hardcoded client authentication key in the product's robot testing framework.
- CISA says successful exploitation could let an attacker deliver an unauthorized update, execute code, or extract credentials and impersonate a privileged client.
- Wärtsilä says the vulnerabilities are not exploitable when the product is installed as recommended, and it has developed a security patch for them.
- Cydome Security Ltd reported the flaws to Wärtsilä and CISA, and CISA says no public exploitation specifically targeting them has been reported to it.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability Recovering the update controller key from one copy of build 5.07.0923.01 gives an attacker a trusted position against other installations of that build, so the return on compromising a single copy is not limited to that copy.
- constraint Because the patch moves through Wärtsilä's engine service channel, the remediation clock belongs to whoever books maintenance windows on the asset, and no IT patch cycle can shorten it.
- contradiction The vendor's position holds only for an installation done as recommended, which leaves operators to prove their own deployment matches before treating the advisory as closed.
Both defects are the same weakness class, CWE-321, use of a hard-coded cryptographic key, and they sit in two separate components of a single build [5][14]. Between them they cover both ends of the update channel: one key authenticates the server, the other authenticates a client [3][4].
The key ships inside the product instead of being generated per installation, and CISA names one version, 5.07.0923.01 [2][15]. An attacker needs one copy of that build and enough time to pull the key out of it, and what comes back is valid against other installations of the same build [15]. FOS-Onboard is deployed worldwide and CISA files it under Transportation Systems [7].
Wärtsilä distributes the fix on request. CISA's remediation text sends users to a Wärtsilä contact page for ICS patch deployment, filed in the services catalogue under four-stroke engine services [9]. Anyone tracking this from a security team will find the action item sitting with the people who book engine maintenance. The published advisory does not include CVSS scores for either CVE [13], so the ranking has to come from the update path itself.
Until the patch is installed, the controls CISA lists are network ones: keep control system devices off the internet, put control networks behind firewalls, isolate them from business networks, and use a VPN when remote access is required [12].
What to watch
- A revision to ICSA-26-258-02 adding CVSS metrics or naming the patched version number.
- Public technical detail on extracting the deployer-ng Update Controller key from a shipped build.
- The first exploitation report reaching CISA against either CVE-2026-78225 or CVE-2026-81855.