## Summary
CVE-2026-81855 describes a hardcoded cryptographic client authentication key vulnerability in the robot testing framework component of Wärtsilä FOS-Onboard. The issue affects Wärtsilä FOS-Onboard version 5.07.0923.01 and has a CVSS 3.1 score of 9.1 (network-reachable, no privileges required).
## Technical Details
- Vulnerability type: CWE-321 Use of Hard-coded Cryptographic Key
- Affected component: robot testing framework within Wärtsilä FOS-Onboard
- Root condition: a cryptographic client authentication key is hardcoded, enabling attackers to authenticate as a privileged client.
- Attack prerequisites: none indicated beyond network access (AV:N, PR:N).
- Likely attacker goals (from CISA advisory context): unauthorized update delivery, code execution, and/or credential extraction to support impersonation of a privileged client.
## Affected
- Wärtsilä FOS-Onboard 5.07.0923.01 (known affected)
## Impact
- Confidentiality impact: C:H (CVSS 3.1) / VC:H (CVSS 4.0)
- Integrity impact: I:H (CVSS 3.1) / VI:H (CVSS 4.0)
- Availability impact: A:N (CVSS 3.1) / VA:N (CVSS 4.0)
- CISA notes exploitation could allow an attacker to impersonate a privileged client, potentially enabling unauthorized updates and code execution.
## Mitigation
1. Patch/upgrade Wärtsilä FOS-Onboard to a vendor-fixed version for the robot testing framework component (follow Wärtsilä/CISA guidance for CVE-2026-81855).
2. If immediate patching is not possible, reduce exposure by restricting network access to the FOS-Onboard robot testing framework interfaces.
3. Use Wärtsilä’s ICS vulnerability management/patch deployment services to ensure OT assets receive security updates in a controlled manner.
4. Monitor for signs of unauthorized client authentication/impersonation attempts and validate update workflows for integrity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-321