CVE-2026-42941: MacGregor Voyage Data Recorder (VDR) G4e Use of Default Credentials

Synopsis

Default credentials in the Danelec MacGregor Voyage Data Recorder (VDR) G4e let anyone who can reach the device log in with a built-in username and password that the device does not force the operator to change. The flaw is reachable from an adjacent network (typically the shipboard LAN) without prior authentication and without any user interaction, giving an attacker high-impact read and write access to recorded voyage data and device settings. A patched-image rebuild at version 5.250 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network such as the shipboard LAN or a connected VPN segment to reach the VDR.

• AuthenticationNot required

  No prior credentials are needed because the device ships with a known default username and password and does not force a change.

• Victim interactionNot required

  No operator action is required; the attacker logs in directly using the documented defaults.

• Attack complexityDetail

  The exploit is reliable and condition-free since the default credentials are static and always accepted.

Blast Radius

• Reads stored voyage data recordings, bridge audio, navigation logs, and device configuration through the authenticated interface.
• Modifies device configuration and persisted recordings, undermining the integrity of voyage evidence used for incident investigation.
• Disrupts recorder availability to a limited extent by altering settings or restarting services on the device.