The vulnerability originates from a hard‑coded cryptographic client authentication key embedded within the robot testing framework component of Wärtsilä FOS‑Onboard. Because the key is static and lacks secure storage or rotation, an attacker who gains access to the software can impersonate a legitimate client, potentially gaining privileged access or controlling system functions. The weakness aligns with CWE‑321, which concerns compromised cryptographic salts or keys.

Affected systems include Wärtsilä FOS‑Onboard. No specific version ranges are listed in the CNA data, so all deployed instances that contain the robot testing framework component could be vulnerable unless a patch has been applied.

The CVSS score of 9.3 indicates high severity, but the EPSS score of less than 1% suggests that successful exploitation in the wild is expected to be rare. The vulnerability is not currently identified in the CISA KEV catalog. While the description does not state the exact attack vector, it is reasonable to infer that the flaw could be leveraged over network connections that use the hard‑coded key for authentication, or by local users with sufficient access to the software environment.