The vulnerability stems from the default username and password credentials that remain unchanged when the MacGregor Voyage Data Recorder G4e devices are deployed. An attacker who can reach the device’s network interface can log in before any authentication policy is applied. This allows the attacker to read and modify the recorder’s configuration and captured data, potentially leading to data loss, tampering, or misuse of the vessel’s operational information. The weakness is a clear case of weak credential information, listed as CWE-1392.

The affected product is the Danelec MacGregor Voyage Data Recorder (VDR) G4e. Devices running firmware versions before V5.250 are vulnerable. The firmware update V5.250, released by Danelec, removes the default credentials or enforces a mandatory password change.

The vulnerability has a CVSS score of 8.7, indicating a high severity. Because no EPSS score is available, the likelihood of exploitation cannot be quantified, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is a local or remote network connection to the VDR, where an attacker could obtain the device through default credentials. The combination of high severity and ease of exploitation presents a significant risk to asset confidentiality and integrity.