The vulnerability arises from the presence of default accounts with hard-coded credentials in the MacGregor Voyage Data Recorder (VDR) G4e firmware. An attacker who discovers these credentials can authenticate to the device without performing legitimate user authentication, enabling them to potentially modify configuration settings, tamper with recorded data, or deploy malicious firmware updates. The weakness is classified as CWE‑798, which in practice can lead to full control over the recorder’s functions.

Danelec’s MacGregor Voyage Data Recorder, model G4e, is affected. Users running firmware versions prior to the released V5.250 update are at risk. The vendor recommends updating to V5.250 at the earliest opportunity rather than awaiting routine service intervals.

The CVSS score of 8.7 signals high severity, and the absence of an EPSS value does not negate a significant exploitation probability, especially for an industrial control system component that is often networked. The device is not listed in the CISA KEV catalog, but the presence of hard-coded credentials provides a straightforward remote or local attack path for an adversary. The likely vector involves network access to the device’s management interface, allowing legitimate credentials to be used to gain entry.