EUVD-2026-33398
GHSA-gcww-537w-9vm7
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (icscert) · only source for this CVE.
CVSS VectorVendor: icscert
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.
AnalysisAI
Weak password storage in the Danelec MacGregor VDR G4E exposes credentials to offline brute-force attack: the hashing algorithm in use both caps maximum password length and provides insufficient computational cost, meaning recovered hashes can be cracked with modest effort. An adjacent-network attacker holding low-privilege access who obtains the stored hashes can recover plaintext credentials and authenticate with elevated privileges to this safety-critical maritime recording system. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the vulnerability affects all known versions of the G4E and is confirmed by CISA ICS advisory ICSA-26-148-01.
Technical ContextAI
The affected product is the Danelec MacGregor Voyage Data Recorder (VDR) G4E, a maritime operational technology (OT) black-box device used aboard vessels to log navigational data including speed, position, audio, and communications. The CPE identifier cpe:2.3:a:danelec:macgregor_voyage_data_recorder_(vdr)_g4e:*:*:*:*:*:*:*:* covers all known versions. The root cause is classified as CWE-916 (Use of Password Hash With Insufficient Computational Effort), meaning the device employs a hashing algorithm that does not require significant computational work to reverse. The additional constraint of a maximum password length strongly suggests a legacy algorithm such as DES-based crypt (which truncates passwords at 8 characters) or a similarly constrained scheme - both of which dramatically reduce the effective keyspace available to defenders. This is an OT-context vulnerability reported by ICS-CERT, meaning the device likely runs embedded firmware with limited patching cadence.
RemediationAI
No specific patched firmware version has been confirmed in the available data. Operators should contact Danelec directly via https://www.danelec.com/contact to obtain firmware update guidance and determine whether a fixed release is available. Per CISA advisory ICSA-26-148-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01), follow vendor-issued instructions. As compensating controls pending a patch: restrict network access to the VDR management interface to only authorized maintenance workstations (reduces the adjacent-network attack surface, though it does not eliminate the hash weakness itself); audit and minimize the number of accounts with any level of access to the device (reduces exposure of additional hash targets); and enforce the longest passwords permitted by the system's constrained length limit (marginally increases brute-force effort within the existing hash scheme's cap). If a firmware update is issued, rotate all VDR credentials immediately afterward to invalidate any hashes that may have been previously extracted.
Authentication bypass via hard-coded credentials in Danelec MacGregor Voyage Data Recorder (VDR) G4e allows attackers wi
Hardcoded default credentials in the Danelec MacGregor Voyage Data Recorder (VDR) G4e allow adjacent attackers to gain a
Authenticated administrator access on the Danelec MacGregor Voyage Data Recorder (VDR) G4E web interface permits direct
Backup download functionality in the Danelec MacGregor Voyage Data Recorder G4E exposes account credentials and password
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today