The vulnerabilities involve the use of a hard-coded cryptographic key in components of the FOS software, and their exploitation could allow a remote unauthorized user to deliver unauthorized updates to the FOS system, execute code, or extract credentials to allow the attacker to impersonate a privileged client.
The most direct consequence could be the ability of an attacker to gain a persistent trusted foothold in the FOS system, basically replacing it with a contaminated version without the operator’s knowledge. This access allows attackers to manipulate operational data, gain access to other OT or IT systems connected to the FOS system, potentially risking operation of the vessel, compliance violation, and financial damage.
First Published Wärtsilä Vulnerability
Wärtsilä is a leading equipment and systems provider for the marine industry, claiming to have solutions installed on one in every three vessels sailing the oceans. Its marine business provides (among others): engines, propulsion and fuel supply equipment as well as marine navigation, fleet optimization and simulation solutions.
Despite Its Impact, Very Few People Are Looking at Maritime OT
Having no published vulnerabilities is not unusual in this sector. While 90% of the world’s goods travel by sea, maritime vessels operate highly specialized maritime systems, especially maritime operational technology (OT). Cybersecurity research as well as the compromise of marine OT requires a high level of expertise that few possess. While advanced generative AI tools lower the bar for cyber attackers and risks becoming more prominent (Cydome research found that the number of OT cyber incidents in 2025 showed a 150% increase), maritime OT cyber research remains largely a blind spot within the cybersecurity community, with very few published CVEs—including the CVEs published earlier this year by the Cydome research team.
“Despite the importance of the maritime industry to the global economy and the potential risk to shipping from cyber threats, cyber research in this field is scarce—especially regarding maritime-specific operational technology (OT). To help the industry become more resilient to the fast-evolving risks, Cydome conducts and publishes proactive research to identify threats and vulnerabilities before they disrupt operations,” said Alon Ayalon, CTO and Co-Founder, Cydome.
What Operators Should Do Now
Exploits of this vulnerability and similar severe vulnerabilities in maritime OT should be prevented by ensuring the following:
- Operators should immediately update by deploying the latest patch that fixes the vulnerabilities.
- Implement proper network segmentation that separates operational elements and OT from IT.
- Ensure no unauthorized remote access is allowed.
- Proactively run ongoing vulnerability scanning to prevent known critical vulnerabilities from being exploited.
- Employ active cybersecurity monitoring using an intrusion detection system that can identify abnormal maritime OT network traffic to discover threats that manage to bypass other defenses or exploit a vulnerability that hasn’t been published yet (Zero Day).
Cydome developed multi-layered cyber protection for maritime vessels rather than adapting office IT tools for the job.
“Maritime operations are transforming with hyper-connectivity through LEO technologies such as Starlink. But this digitalization, combined with the rapid adoption of AI, also expands the attack surface of critical OT assets. Cyber risk can no longer be managed reactively; organizations need continuous, active risk management embedded into their operational processes to protect vessels and the systems they depend on, and not rely on legacy solutions to protect their OT,” said Ayalon. “Operators should not wait for a CVE to identify gaps in their cybersecurity; they should proactively deploy protection and continuously manage their cyber risks,” added Alon Ayalon, CTO and Co-Founder, Cydome.
The flaw in the Wärtsilä software was discovered and shared in a responsible disclosure process through CISA. It is the ninth CVE and the third maritime product line Cydome’s research team has published vulnerabilities in this year, following CVEs in Metis devices and NAVTOR NavBox.
Wärtsilä Response to the Findings
As part of the CISA advisory, Wärtsilä is quoted as stating that the vulnerabilities are not exploitable when the product is installed as recommended, and it has developed a security patch. Users are also directed to contact Wärtsilä to obtain and install the patch. To obtain and install the latest patch, contact Wärtsilä directly.
