CVE-2026-78225

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard. The key is embedded in the software and cannot be changed by administrators.

Anyone who knows the embedded key can impersonate the server or decrypt protected communication, potentially taking control of the update process. This may result in deployment of malicious software or a breach of system integrity.

Apply the vendor patch that removes the hardcoded key or allows it to be rotated immediately. Until patched, restrict network access to the deployer-ng Update Controller component.