The vulnerability exists in the password storage mechanism of the MacGregor Voyage Data Recorder (VDR) G4e, where a hashing method imposes a limited password length and is susceptible to brute force attacks. An attacker who can obtain repeated authentication attempts may compromise user accounts by iterating over a manageable search space, thereby gaining unauthorized system access. The weakness is identified as CWE‑916, indicating insufficient cryptographic storage of credentials.

This issue affects all installations of Danelec's MacGregor Voyage Data Recorder G4e devices. There are no specific version constraints listed beyond the need for firmware upgrade to the V5.250 release for remediation.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score is currently not available, implying no known exploitation probability data. Because the vulnerability lies in credential processing, the likely attack vector is through authentication attempts, either locally or remotely, depending on the device’s exposure. The vulnerability is not listed in the CISA KEV catalog, so no confirmed exploitation has been reported yet, but the potential for brute‑force compromise remains significant if default or weak passwords are used.