EUVD-2026-33396
GHSA-qm89-g8jg-hcwp
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (icscert) · only source for this CVE.
CVSS VectorVendor: icscert
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder
device which includes account data and password hashes.
AnalysisAI
Backup download functionality in the Danelec MacGregor Voyage Data Recorder G4E exposes account credentials and password hashes to any authenticated low-privileged user. An attacker with a valid low-privilege account operating on the same adjacent network segment - typically the onboard vessel LAN - can retrieve a device backup file containing credential material, enabling offline password cracking and potential privilege escalation. No public exploit identified at time of analysis, but the maritime OT context and CISA ICS advisory issuance (ICSA-26-148-01) underscore relevance to vessel operational security.
Technical ContextAI
The affected product is the Danelec MacGregor Voyage Data Recorder G4E (CPE: cpe:2.3:a:danelec:macgregor_voyage_data_recorder_(vdr)_g4e:*:*:*:*:*:*:*:*), a maritime OT device that records navigational and voyage data aboard ships and is subject to IMO SOLAS regulatory requirements. The vulnerability is classified as CWE-522 (Insufficiently Protected Credentials), meaning the device's backup artifact - accessible via an authenticated backup download function - bundles account usernames and password hashes without adequate restriction or sanitization. The root cause is a failure to exclude or encrypt sensitive credential material from user-accessible backup exports, a common OT device design deficiency where backup completeness is prioritized over credential hygiene.
RemediationAI
No vendor-released patch with an exact fix version has been identified at time of analysis. Operators should contact Danelec directly via https://www.danelec.com/contact to inquire about firmware updates addressing this issue and consult the full CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01 for any vendor-recommended mitigations. As compensating controls: restrict backup download permissions to only the highest-privilege administrative role on the VDR to reduce the number of accounts capable of triggering the exposure - note this may require reviewing onboard crew account provisioning. Enforce strong, unique passwords for all VDR accounts to increase offline cracking resistance against any disclosed hashes. Segment the VDR onto a dedicated isolated vessel network VLAN accessible only to authorized personnel, reducing the adjacent-network attack surface - be aware this may affect integration with bridge monitoring systems. Rotate all VDR account credentials immediately if any backup files have been downloaded by non-administrative users.
Authentication bypass via hard-coded credentials in Danelec MacGregor Voyage Data Recorder (VDR) G4e allows attackers wi
Hardcoded default credentials in the Danelec MacGregor Voyage Data Recorder (VDR) G4e allow adjacent attackers to gain a
Authenticated administrator access on the Danelec MacGregor Voyage Data Recorder (VDR) G4E web interface permits direct
Weak password storage in the Danelec MacGregor VDR G4E exposes credentials to offline brute-force attack: the hashing al
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today