Our takeCISA reports active exploitation in Wärtsilä FOS-Onboard 5.07.0923.01 that lets attackers push unauthorized updates, run code, or steal credentials. Patch immediately if you run these systems.Cyber Resilience desk
Sources (1)
- cisa_ics · cisa_ics
What this means for you — Security leader:CISA reports active exploitation of two vulnerabilities in Wärtsilä FOS-Onboard 5.07.0923.01 that could allow unauthorized updates, code execution, or credential extraction. Update to a fixed version immediately if you operate this system; treat all internet-facing instances as high priority.
What this means for you — Lean IT orgs:If you run Wärtsilä FOS-Onboard version 5.07.0923.01 on any vessel or site, update it now. CISA says attackers are already using these flaws to run code or steal credentials.
What this means for you — MSP:Check every client running Wärtsilä FOS-Onboard 5.07.0923.01 and apply the vendor update. CISA confirms active exploitation that can lead to code execution or credential theft.
What this means for you — Researcher:CISA advisory ICSA-26-258-02 details two vulnerabilities in Wärtsilä FOS-Onboard 5.07.0923.01 under active exploitation, enabling unauthorized updates, code execution, or credential extraction for client impersonation.