CVE-2026-42941
Default Credentials in Danelec MacGregor Voyage Data Recorder
Publication date: 2026-05-29
Last updated on: 2026-05-29
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| danelec | macgregor_voyage_data_recorder | 5.250 |
| danelec | csafpid_0001 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1392 | The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves default usernames and passwords with no enforced password change, which can lead to unauthorized access to the device.
Such unauthorized access risks compromising confidentiality, integrity, and availability of data, which are critical aspects of compliance with standards like GDPR and HIPAA.
Failure to secure devices against unauthorized access may result in non-compliance with these regulations, as they require protection of sensitive data and proper access controls.
Can you explain this vulnerability to me?
The Danelec MacGregor Voyage Data Recorder device includes a default username and password that are not required to be changed by the user.
This means the device uses hard-coded credentials embedded in its firmware, allowing attackers to gain unauthorized access.
Such unauthorized access can potentially lead to administrator-level control of the device.
How can this vulnerability impact me? :
This vulnerability can allow attackers to gain unauthorized access to the Voyage Data Recorder device.
With such access, attackers may achieve administrator-level control, which can compromise the confidentiality, integrity, and availability of the device and its data.
This could lead to manipulation or loss of critical voyage data, potentially impacting vessel operations and safety.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability involves default usernames and passwords embedded in the device firmware, allowing unauthorized access.
To mitigate this vulnerability, users should promptly update their MacGregor Voyage Data Recorder devices to the vendor-released firmware version V5.250, which addresses the issue.