EUVD-2026-33403
GHSA-3cp8-799v-mwxm
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (icscert) · only source for this CVE.
CVSS VectorVendor: icscert
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The administrator account for the
Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.
AnalysisAI
Authenticated administrator access on the Danelec MacGregor Voyage Data Recorder (VDR) G4E web interface permits direct editing of sensitive authentication files, including the ability to overwrite the root password. The CVSS vector (AV:A/AC:L/PR:H/UI:N) confirms exploitation requires both adjacent network positioning and existing high-privilege credentials, meaning this is not a remotely exploitable unauthenticated attack path. Reported by ICS-CERT under advisory ICSA-26-148-01 as a maritime OT device concern, no public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
The affected product is the Danelec MacGregor Voyage Data Recorder VDR G4E (CPE: cpe:2.3:a:danelec:macgregor_voyage_data_recorder_(vdr)_g4e:*:*:*:*:*:*:*:*), a maritime safety-critical device mandated by IMO regulations to record voyage and bridge data aboard ships. The web-based management interface exposes functionality that allows an administrator-level user to directly read and modify files on the underlying filesystem - specifically files governing authentication, such as those storing or referencing the root account password. CWE-552 (Files or Directories Accessible to Unauthorized Actors) captures the root cause: sensitive OS-level files are reachable and writable through the application layer in a manner that exceeds the intended privilege boundary of the 'administrator' role. This blurs the separation between application-layer admin privileges and OS-level root access. The adjacent network attack vector (AV:A) indicates the web interface is only reachable from a directly connected or bridged network segment, consistent with maritime shipboard network architectures where the VDR management interface is typically on a segregated bridge network.
RemediationAI
The primary remediation action is to consult the CISA ICS advisory ICSA-26-148-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01) and contact Danelec directly at https://www.danelec.com/contact for patch or firmware update availability - no specific fixed version number is confirmed in the available input data, so a vendor-released patch version cannot be cited at time of analysis. As a compensating control, restrict network access to the VDR web management interface to only authorized administrative workstations using shipboard network segmentation or VLAN controls, reducing the adjacent-network attack surface. Additionally, enforce strong, unique administrator passwords for the VDR web interface and rotate credentials regularly, which limits the PR:H prerequisite from being met by credential-reuse or default-credential attacks. Operators should audit administrator accounts and review whether any unauthorized modifications to authentication files have already occurred. Note that network segmentation alone does not eliminate the vulnerability - it only raises the bar for initial network access.
Authentication bypass via hard-coded credentials in Danelec MacGregor Voyage Data Recorder (VDR) G4e allows attackers wi
Hardcoded default credentials in the Danelec MacGregor Voyage Data Recorder (VDR) G4e allow adjacent attackers to gain a
Backup download functionality in the Danelec MacGregor Voyage Data Recorder G4E exposes account credentials and password
Weak password storage in the Danelec MacGregor VDR G4E exposes credentials to offline brute-force attack: the hashing al
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today