The flaw permits an authenticated user to download a backup of a Danelec MacGregor Voyage Data Recorder that includes account data and password hashes. This exposure of credential information can facilitate credential compromise or lateral movement within connected systems. The weakness stems from insufficient protection of credentials stored in the backup, falling under the category of credentials stored insecurely.

The vulnerability impacts Danelec MacGregor Voyage Data Recorder (VDR) G4e units. All devices that have not yet been upgraded to firmware version V5.250 are affected. No additional version constraints are specified in the advisory.

The CVSS score is 5.9, indicating a medium severity. No EPSS score is available and the issue is not listed in CISA’s KEV catalog. Exploitation requires legitimate authenticated access; once an attacker logs in, they can trigger the backup download and obtain the stored credential hashes. The primary risk is confidentiality compromise; the likelihood of exploitation is limited to users who possess valid credentials and can access the backup function.