CVE-2026-42929: MacGregor Voyage Data Recorder (VDR) G4e Use of Hard-coded Credentials

Synopsis

Hard-coded credential exposure in the Danelec MacGregor Voyage Data Recorder (VDR) G4e. The device ships with default accounts whose passwords are baked into the firmware, reachable by any attacker on the same network segment as the VDR without further authentication or user interaction. Successful login grants high-impact read and write access to recorded voyage data and device configuration. A patched firmware build at version 5.250 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network such as the ship's LAN or a connected VPN segment; the VDR is not exploitable from the open internet by default.

• AuthenticationNot required

  No prior authentication is needed because the hard-coded credentials themselves serve as the entry point.

• Victim interactionNot required

  Exploitation is fully attacker-driven and does not require any action from a crew member or operator.

• Attack complexityDetail

  The CVSS vector marks attack complexity as low; once the default credentials are known, login is reliable and condition-free.

Blast Radius

• Reads stored voyage data recordings, including bridge audio, radar, and navigation telemetry held on the device.
• Modifies or deletes recorded voyage data and device configuration, undermining the integrity of the casualty-investigation record the VDR exists to preserve.
• Causes limited disruption to VDR availability, such as degraded recording or service interruption on the unit.