CVE-2026-78225
A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.5
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS probability
- 0.41%
- CWE
- CWE-321
- Published
- 2026-09-15
- Last modified
- 2026-09-16
Affected products
- Wärtsilä FOS-Onboard
Weakness type
Related vulnerabilities
- CVE-2025-30406 — Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the
- CVE-2025-13316 — Hard-coded encryption keys in Twonky Server
- CVE-2025-34217 — Vasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH Key
- CVE-2025-12599 — Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)
- CVE-2026-25505 — Bambuddy Uses Hardcoded Secret Key + Many API Endpoints do not Require Authentication
- CVE-2026-22906 — Hardcoded Key Allows Credential Disclosure
- CVE-2025-8625 — Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution
- CVE-2025-41702 — egOS WebGUI Hard-Coded JWT Secret Enables Authentication Bypass