End-of-Life AIS Transponder Leaves Vessels Exposed to Unauthenticated Config Attacks
The FURUNO FA-50 AIS Transponder contains two critical vulnerabilities — one allowing authenticated users to alter device settings and another enabling configuration changes with no authentication at all. Because the product reached end-of-life in October 2020, no patches will ever be issued, leaving all deployed units permanently vulnerable. This is a textbook example of the risks posed by legacy, unsupported hardware in operational technology (OT) environments where safety and navigation are at stake. Attackers exploiting these flaws could manipulate AIS data, disrupt maritime situational awareness, or use the device as a pivot point into the vessel's broader network. The inability to patch underscores why lifecycle management and network isolation are critical compensating controls.
Tactical Insight
Immediate actions
- Disconnect the FURUNO FA-50 from any direct internet-facing interfaces and isolate it on a dedicated, firewalled network segment.
- Audit all vessel network devices to identify other end-of-life or unpatched hardware that may present similar risks.
Long-term improvements
- Establish a formal hardware lifecycle policy that mandates replacement planning before vendor end-of-life dates are reached.
- Replace the FA-50 with a supported AIS transponder model that receives active security updates and patches.
- Maintain a continuously updated asset inventory that tracks firmware versions, support status, and known CVEs for all OT/IoT devices.
Detection measures
- Deploy network monitoring tools to detect unauthorized configuration change attempts or anomalous traffic targeting the AIS transponder.
- Implement alerting for any unexpected inbound connections to maritime navigation equipment on the vessel network.