EUVD-2026-33395
GHSA-fvxq-cq6f-h294
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (icscert) · only source for this CVE.
CVSS VectorVendor: icscert
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
The Danelec MacGregor Voyage Data Recorder
device includes a default username and password, with no enforced password change.
AnalysisAI
Hardcoded default credentials in the Danelec MacGregor Voyage Data Recorder (VDR) G4e allow adjacent attackers to gain administrative access to the maritime black-box recorder without any password change being enforced at deployment. The flaw was reported through ICS-CERT (advisory ICSA-26-148-01) and carries a CVSS 4.0 score of 8.7, reflecting high confidentiality and integrity impact over an adjacent network with no privileges or user interaction required. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
The Voyage Data Recorder (VDR) is the maritime equivalent of an aircraft's black box, capturing navigation, voice, radar, and sensor data for incident reconstruction on commercial vessels. The affected product, identified by CPE cpe:2.3:a:danelec:macgregor_voyage_data_recorder_(vdr)_g4e, is the G4e generation of the Danelec/MacGregor VDR platform, typically reachable over the ship's onboard IP network. The root cause is CWE-1392 (Use of Default Credentials): the device ships with a known username/password pair and does not force operators to change it during commissioning, leaving any deployment that skips manual hardening trivially accessible to anyone with network reach.
RemediationAI
No vendor-released patch version is identified in the available data; remediation must therefore be operational. Immediately change the default username and password on every deployed VDR G4e unit to a strong, unique credential per vessel, and document the change in the ship's cybersecurity management plan as required under IMO MSC-FAL.1/Circ.3. Contact Danelec via https://www.danelec.com/contact for any firmware update that enforces a mandatory password change at first boot, and follow the mitigation guidance in CISA advisory ICSA-26-148-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01). As compensating controls, isolate the VDR on a dedicated VLAN with strict ACLs limiting access to authorized bridge and maintenance workstations only, disable any unused management interfaces, and monitor authentication attempts on the device - accepting the trade-off that segmentation may complicate legitimate post-incident data retrieval by surveyors or accident investigators who must then be granted temporary access.
Authentication bypass via hard-coded credentials in Danelec MacGregor Voyage Data Recorder (VDR) G4e allows attackers wi
Authenticated administrator access on the Danelec MacGregor Voyage Data Recorder (VDR) G4E web interface permits direct
Backup download functionality in the Danelec MacGregor Voyage Data Recorder G4E exposes account credentials and password
Weak password storage in the Danelec MacGregor VDR G4E exposes credentials to offline brute-force attack: the hashing al
Same weakness CWE-1392 – Use of Default Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today