The Web interface’s administrator account can directly edit sensitive authentication files, enabling an attacker to alter the root password. This flaw allows elevated access or further tampering with system credentials, potentially leading to full control of the device. The weakness aligns with CWE‑552: Access Control Weakness.

MacGregor Voyage Data Recorder (VDR) G4e devices produced by Danelec, affected by firmware versions before V5.250. The vendor recommends updating to firmware V5.250 or later to fix the issue.

The CVSS score of 6.9 indicates a medium‑to‑high risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the web interface, typically through existing administrator credentials or a compromised account. Once authenticated, an attacker can change the root password, enabling persistent or elevated access.