CVE-2026-42929

Executive Summary

CVE-2026-42929 is a high-severity hard-coded credentials vulnerability affecting the Danelec MacGregor Voyage Data Recorder (VDR) G4e maritime system. The device ships with default accounts that use embedded, unchangeable credentials, allowing an authenticated attacker on the adjacent network to obtain full administrative access to the VDR, compromise the integrity of voyage data logs, and potentially manipulate or erase critical safety records. The vulnerability carries a CVSS score of 8.3 (High) and requires low-privilege access on the local network segment, but the scope change and high confidentiality/integrity impact make it a serious risk for commercial fleets. A firmware fix (V5.250) has been claimed by the CNA but not independently confirmed.

Technical Analysis

The MacGregor Voyage Data Recorder (VDR) G4e is a maritime safety system mandated by the International Maritime Organization (IMO) to continuously record voyage data—navigation, engine telemetry, bridge audio, radar imagery, and alarm states—for post-incident forensic analysis. The device must survive catastrophic events, which historically led manufacturers to place operational simplicity above security hardening. CVE-2026-42929 stems from exactly this trade-off: the device firmware embeds default administrative accounts with static, predictable credentials directly in the software image.

The vulnerability class is CWE-798 (Use of Hard-coded Credentials). Information from the CNA indicates that the device includes default accounts with credentials stored in the firmware binary, likely in plaintext or with a reversible encoding (common in embedded systems where the developer needs service access). These credentials are identical across all devices of the same model and firmware generation, meaning that once one device is compromised—or the firmware image is extracted and analyzed—an attacker gains universal access to every deployed unit.

From a code-level perspective, the vulnerability is typically located in one of two places. First, a dedicated maintenance/service account may be defined in the device's configuration files (e.g., /etc/passwd, a proprietary auth database, or a web server config) with a hard-coded password hash. Second, the WebUI or API authentication module may contain an unconditional comparison against a static string, e.g., if (strcmp(password, "admin") == 0) { grant_admin(); }. Either implementation allows bypassing the intended access control mechanism.

The attack surface is the device's management interfaces: a WebUI over HTTP/HTTPS (typically port 80/443), a serial console, and potentially a Telnet/SSH service. Given the "Adjacent Network" (AV:A) vector in the CVSS score, the attacker must be on the same broadcast domain or routable segment as the VDR. In a maritime environment, this is achievable through the ship's onboard local area network (LAN), a compromised bridge workstation, or by plugging into an unused network port. The "Low" privilege requirement (PR:L) indicates the attacker needs only a standard user account on that network—not even a VDR account—or possibly a low-privilege VDR account to leverage the hard-coded admin credentials for privilege escalation.

The "Scope Change" (S:C) component is notable: it indicates the vulnerable component (VDR authentication logic) affects a system other than the one directly compromised. Exploitation can pivot from the network access into the full VDR data plane. The high confidentiality and integrity impacts (C:H/I:H) reflect that a successful compromise grants complete read/write access to all recorded voyage data, including the ability to alter or delete logs.

Exploitation Scenarios

The following is the expected attack chain, even absent a public PoC:

Step 1 — Reconnaissance: An attacker with access to the ship's LAN performs a network sweep for VDR devices. The device responds on port 80/443 (WebUI) and may respond to SNMP or proprietary service discovery. Tools like Nmap (nmap -p 80,443,22,23 --open 10.0.0.0/24) identify the host. The WebUI banner or HTTP title (e.g., "VDR G4e" or a Danelec login page) confirms the model. Alternatively, the attacker sends a benign request to the status endpoint (e.g., /status.json) that leaks the firmware version, confirming it is below V5.250.

Step 2 — Credential Extraction (Offline): The attacker obtains a copy of the VDR firmware image (from a partner site, a device retrieved from a scrapped vessel, or a direct download if the vendor makes it available). The attacker runs binwalk or strings on the firmware to extract the filesystem. A simple strings firmware.bin | grep -i "password" reveals the hard-coded admin password, or a tool like firmwalker identifies hard-coded credential patterns in configuration files.

Step 3 — Authentication Bypass (Online): The attacker navigates to the VDR WebUI (http://10.0.0.25/login). They submit the maintenance/admin username with the extracted hard-coded password. Since the password is identical across all VDR G4e devices running pre-V5.250 firmware, the authentication succeeds, returning a session cookie with administrator privileges. The attacker does not need to brute-force or use a dictionary attack—the credential is a static, deterministic value.

Step 4 — Post-Exploitation: With admin access, the attacker can:

• Read all voyage data: Download the complete VDR log archive, including GPS tracks, engine telemetry, and bridge audio recordings via the WebUI's export functionality.
• Modify/delete logs: Use the device's maintenance API to re-index, truncate, or replace log files. On a VDR, logs are often stored on a removable/ruggedized medium; the attacker could force a re-recording that overwrites the protected period.
• Create a backdoor: Change the admin password (if the interface allows it) to lock out legitimate operators, or enable a remote access service (Telnet/SSH) if not already active.
• Lateral movement: Use the VDR as a pivot to reach other shipboard systems—navigation (ECDIS), the Integrated Bridge System (IBS), or even the automation control network—since the VDR is already connected to the ship's data distribution unit.

Related scenario — physical port access: A crew member, stevedore, or visitor plugging a laptop into an unused network jack on the bridge or engine room gets the same network-level access. If the ship's network does not segment the VDR from the operational LAN, the attack surface expands.

Impact Assessment

CVSS Sub-scores: The base score of 8.3 stems from AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The absence of user interaction (UI:N), low complexity (AC:L), and low privilege requirement (PR:L) make exploitation trivial once network adjacency is achieved. The scope change (S:C) amplifies impact beyond the VDR itself, affecting the entire vessel's data integrity ecosystem.

Business Impact: For a commercial shipping operator, this vulnerability has legal, regulatory, and financial consequences. VDR data is used in marine accident investigations (by flag states, P&I clubs, and classification societies). A compromised VDR could lead to:

• Regulatory non-compliance: IMO SOLAS Chapter V Regulation 20 mandates that VDRs operate continuously. A device with a backdoored admin account that can stop recording or alter data fails this mandate, exposing the operator to port state control (PSC) detention.
• Litigation risk: In a maritime incident (collision, grounding, oil spill), tampered VDR data undermines the operator's legal defense and may trigger criminal liability for obstruction of justice or falsification of evidence.
• Operational intelligence loss: The VDR contains proprietary route planning, engine performance parameters, and crew behavior data; its exfiltration is a competitive and security risk.
• Blast radius: Beyond the individual ship, if a fleet uses the same firmware across all vessels, a single attacker with one credential can compromise the entire fleet, one vessel at a time. The EPSS score of 0.00226 (13.4% percentile) suggests low in-the-wild exploitation currently, but the attack surface is persistent and not patched-by-default, so the risk will rise as public awareness grows.

Affected Assets: All MacGregor VDR G4e units with firmware earlier than V5.250. The affected version list from the CNA is currently empty (marking an uncertainty over the exact first vulnerable version), but recommended patching is to V5.250 or later. The system is not in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public PoC or exploit code exists; however, the attack technique for hard-coded credentials is well-documented and trivial to reproduce.

Detection Guidance

The following detection rules assume the attacker attempts online authentication against the VDR WebUI/API or interacts with the device's data export/log modification endpoints. They are best-effort and should be tailored to your environment.

Sigma Rule

title: Suspicious Login Attempt to Danelec VDR G4e WebUI
id: 74ecba2f-8c32-47ba-9b3a-4a5b1c2d09e1
status: experimental
description: Detects login attempts to a VDR G4e web interface using multiple usernames or repeated failed attempts, possibly indicating hard-coded credential exploitation attempts.
logsource:
    category: application
    product: web
detection:
    selection:
        http.response.body|contains: "VDR G4e"
    condition: selection
level: medium
tags:
    - attack.t1213
    - cve.2026.42929

Note: A more effective Sigma rule would require authentication logs from the VDR itself, which are not standardized. This rule broadly targets the WebUI response marker.

YARA Rule

rule Detect_VDR_G4e_Hardcoded_Creds
{
    meta:
        author = "valtersit.com SOC"
        description = "Detects strings in firmware/scripts associated with hard-coded credentials in MacGregor VDR G4e"
        cve = "CVE-2026-42929"
        date = "2026-06-15"
    strings:
        $s1 = "admin" ascii wide
        $s2 = "password" ascii wide
        $s3 = "VDR_G4e" ascii wide
        $s4 = "maintenance" ascii wide
        $s5 = "default_cred" ascii wide
        $s6 = "hardcoded" ascii wide
    condition:
        uint16(0) == 0x5A4D or
        any of ($s*) and
        filesize < 100MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Danelec VDR G4e Potential Admin Login Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/login"; http.user_agent; content:"curl|20|"; http.request_body; pcre:"/(user|username|login|pass|password)=/i"; classtype:attempted-admin; sid:2026429290; rev:1;)

Note: This is a crude detection of a login POST to the VDR. Adjust http.uri and headers to match observed device traffic once validated in your lab.

Elastic Detection

// Detect multiple distinct username fields in requests to a VDR login endpoint
sequence by source.ip with maxspan=5m
  [any where destination.port == 80 and
    url.path == "/login" and
    url.query contains "user="]
  [any where destination.port == 80 and
    url.path == "/login" and
    url.query contains "user=" and
    url.query != _prev.url.query]

Splunk SPL Query

index=web sourcetype="access_combined" uri="/login" src_ip!="10.0.0.1"
| stats count BY src_ip, http_user_agent
| where count > 5
| table _time, src_ip, http_user_agent, count
| sort - count

Note: This detects brute-force behavior on a VDR login page from a single source IP—a strong signal of attempts to guess or use multiple credentials.

Wazuh OSSEC Rule

<group name="vdr_g4e,">
  <rule id="458376" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">login</field>
    <field name="response_code">^401</field>
    <description>Unsuccessful login attempts to VDR G4e web ui</description>
    <group>authentication_failed,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). Proceed with patching but validate post-patch integrity.

1. Immediate Mitigations:

   • Isolate the VDR network: Place the VDR on a dedicated VLAN segment with strict firewall rules. Restrict access to only the bridge workstation and the mandatory data distribution unit (DDU). Block all inbound traffic from passenger, crew, and visitor network segments.
   • Disable/change default accounts immediately: If the device interface allows, change the admin password at install. If not, ensure the device is not reachable from untrusted segments until the firmware upgrade.
   • Monitor management interfaces: Enable logging on the WebUI and correlate logs as shown in the detection guidance. Treat any failed admin login as a security incident.
   • Physical security: Restrict physical access to the VDR unit and its network ports; lock the bridge and engine control room.

2. Patch/Upgrade Steps:

   • Contact Danelec or consult their service portal to obtain firmware V5.250. The CNA advisory (ICS-CERT/ICS-CERT coordinated) indicates this version resolves the hard-coded credential issue.
   • Do not wait for the annual performance test. The vendor explicitly recommends immediate firmware update "at the earliest service attendance." Schedule the update before the next voyage or during a port stay.
   • Follow standard maritime change management: backup current VDR configuration and data (if possible) before upgrade, test the new firmware on a single vessel, then roll out fleet-wide.
   • After upgrade, verify the default credentials are actually removed or rotated by attempting login with the old hard-coded values.

3. Long-term Hardening:

   • Fleet-wide inventory: Maintain a register of all VDR models, firmware versions, and the ship-specific network segmentation.
   • Network monitoring: Deploy passive monitoring on the VDR VLAN to alert on any communication with unknown IPs. Correlate with the Suricata/Sigma rules above.
   • Zero trust for maritime OT: Treat all shipboard assets as critical OT. Implement 802.1X on bridge network ports to prevent rogue device connection.
   • Engage vendor: Inquire with Danelec about future security advisories, responsible disclosure policies, and whether they publish security hardening guides or CVEs for their product line.
   • Staff awareness: Train bridge officers and engine crew that the VDR is a safety device, not just a "black box," and that suspicious behavior (unexpected popups, network disconnections, service restarts) should be reported to the shore-side IT/SOC.

References

1. NVD Entry: NVD - CVE-2026-42929 — NVD description and CVSS details.
2. ICS-CERT Advisory (CNA): ICS-CERT coordinated disclosure for MacGregor VDR G4e hard-coded credentials; vendor fix V5.250. (URL to be retrieved from ICS-CERT page when published).
3. Danelec Contact Page: Danelec Contact — Vendor contact for firmware patch distribution and support.
4. CWE-798 Reference: MITRE CWE-798 — Use of hard-coded credentials, detailed technical descriptions.
5. MITRE ATT&CK T1213: Data from Information Repositories — Applicable tactic for reading VDR data repository.

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at the time of writing. The EPSS score (0.00226) places this vulnerability in the 13.4th percentile of exploited CVEs, indicating low immediate exploitation but a persistent risk due to the ease of the attack technique.