EUVD-2026-33400
GHSA-84hh-5gvq-fvr4
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (icscert) · only source for this CVE.
CVSS VectorVendor: icscert
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.
AnalysisAI
Authentication bypass via hard-coded credentials in Danelec MacGregor Voyage Data Recorder (VDR) G4e allows attackers with adjacent-network access to log in using undocumented default accounts and gain high-impact access to confidentiality and integrity of recorded voyage data. The flaw was disclosed via CISA ICS-CERT advisory ICSA-26-148-01 and carries a CVSS v4.0 score of 8.7, with no public exploit identified at time of analysis and no CISA KEV listing.
Technical ContextAI
The affected device is a maritime Voyage Data Recorder - the shipborne equivalent of an aircraft black box - manufactured by Danelec under the MacGregor brand (CPE cpe:2.3:a:danelec:macgregor_voyage_data_recorder_(vdr)_g4e). VDRs continuously capture bridge audio, radar imagery, AIS data, navigational sensor feeds, and alarms for post-incident forensic review and are mandated under IMO SOLAS Chapter V for many commercial vessels. The root cause maps to CWE-798 (Use of Hard-coded Credentials): the firmware ships with built-in default accounts whose passwords are embedded in the product and cannot be removed by the operator, meaning anyone who learns or extracts those credentials can authenticate as if they were a legitimate administrator. This class of flaw is common in operational technology where devices are presumed to live on isolated networks and where vendors embed service accounts for remote support.
RemediationAI
No vendor-released patch version was independently confirmed from the supplied references, so operators should contact Danelec directly via https://www.danelec.com/contact and review the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01 to obtain the fixed firmware build and any vendor-supplied credential-rotation procedure for the G4e platform. Until a verified firmware update is deployed, compensating controls should include strict network segmentation that isolates the VDR onto a dedicated shipboard VLAN with no routing to crew, passenger, or satcom networks, ACL-based restriction of management ports to the bridge engineering workstation only, disabling or physically disconnecting any unused Ethernet maintenance interfaces, and monitoring the VDR's authentication logs (where supported) for logins from unexpected source addresses; note that segmentation may interfere with shore-side remote diagnostics workflows that vendors and class societies rely on, and credential changes may not be possible at all because the accounts are hard-coded in firmware. CISA's published ICS mitigation guidance referenced in the advisory should be applied in parallel.
Hardcoded default credentials in the Danelec MacGregor Voyage Data Recorder (VDR) G4e allow adjacent attackers to gain a
Authenticated administrator access on the Danelec MacGregor Voyage Data Recorder (VDR) G4E web interface permits direct
Backup download functionality in the Danelec MacGregor Voyage Data Recorder G4E exposes account credentials and password
Weak password storage in the Danelec MacGregor VDR G4E exposes credentials to offline brute-force attack: the hashing al
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today