CVE-2026-42941

Executive Summary

CVE-2026-42941 is a critical authentication bypass vulnerability in the Danelec MacGregor Voyage Data Recorder (VDR) G4e, an IMO-mandated maritime safety device installed on commercial vessels. The device ships with a default username and password combination that is not enforced for change, allowing any unauthenticated remote attacker who knows the default credentials to gain full administrative access to the device over the network.

The vulnerability carries a CVSS score of 8.3 (High) due to network-based exploitation with no privileges required and high confidentiality impact. Successful exploitation can result in complete compromise of voyage recording data — including tampering with or deletion of navigation, radar, and audio recordings that are legally required for maritime accident investigation — and potential lateral movement into the ship's broader OT/IT network. The vendor (Danelec) has released firmware V5.250 as a claimed fix, though this has not yet been independently verified. Notably, the EPSS score is 0.00226 (13.4% percentile) , indicating low current exploitation activity, and the CVE is NOT listed in CISA KEV. However, the sensitivity of maritime safety data and the regulatory implications of its tampering make this a high-priority finding for shipping enterprises, port authorities, and maritime security teams.

Technical Analysis

The MacGregor Voyage Data Recorder (VDR) G4e is a ruggedized data acquisition and storage device designed to comply with IMO Resolution MSC.333(90) and IEC 61996-1 standards. It continuously records voyage data including GPS position, engine telemetry, radar images, VHF communications, and bridge audio, storing this data in a tamper-proof capsule for post-incident analysis.

The vulnerability (CWE-1392 — Use of Default Credentials) exists in the device's web management interface. The firmware ships with a factory-default administrative account whose username and password are hardcoded and documented in the device manual and service documentation. Critically, the device offers no forced password change on first login and no password expiration policy. This means:

1. Authentication Bypass Surface: An attacker who can reach the device's management interface (typically TCP/80 or TCP/443 for HTTP/HTTPS management, possibly additional proprietary ports) can authenticate with the default credentials without any prior knowledge or network reconnaissance beyond discovering the device.

2. Impact on Cryptographic Integrity: While the VDR uses tamper-detection mechanisms (and the capsule itself has physical seals), the management interface provides the ability to read, export, and potentially manipulate pre-capsule data. If the attacker accesses configuration options, they may be able to disable recording channels, alter clock/synchronization settings, or corrupt the live database that feeds the capsule, thereby undermining the integrity of official records without physically breaching the capsule seals.

3. Attack Vector — Network: The CVSS vector (AV:N, PR:N) confirms the attack is remotely exploitable without authentication. Maritime vessels typically run an "internet of rudders" network where the VDR is connected to a shipboard LAN alongside navigation, propulsion control, and communications systems. In many installations, this LAN has an uplink to satellite internet (VSAT/Inmarsat) or at minimum is reachable from the ship's "officer LAN" where crew laptops connect.

4. Attack Surface — Additional Services: Beyond the web interface, the G4e family may expose SNMP, FTP, or proprietary UDP-based data feed ports that could also accept credentials or allow unauthenticated data queries. The default credential set is likely shared across these services.

5. Firmware Handling: The CNA advisory indicates the issue is resolved in firmware version V5.250. The absence of detailed patch notes (only "resolves these vulnerabilities" is stated) and the single-source confirmation lowers patch confidence to 2/4. There may be additional undisclosed fixes in the same firmware that are not described.

6. Confidentiality Impact (High): The VDR holds a complete, continuous record of voyage audio (bridge VHF and ambient microphones), radar display captures, and all navigational sensor data. This is a goldmine for corporate espionage (route planning, operational parameters), smuggling operations (identifying patrol vessel movement patterns), or insurance fraud (proving or disproving alleged incidents).

Exploitation Scenarios

This vulnerability belongs to the "default credentials" class, making exploitation trivial once the device is reachable. The following is a concrete attack chain an adversary would execute:

Scenario A: Remote Unauthenticated Takeover of VDR Data

1. Reconnaissance (Discovery): The attacker, likely a maritime-oriented threat actor (e.g., cyber-pirate syndicate, organized smuggling group, or state-sponsored maritime intelligence unit), performs internet-wide scanning using Shodan or Censys for exposed shipboard networks. The attacker filters for devices responding on common VDR/industrial web interfaces with banners containing "VDR", "MacGregor", or ICS-proto HTTP headers. Alternatively, the attacker leverages a passive DNS database or a known vessel's public VSAT configuration to obtain the ship's external IP, then probes the WAN-facing management interface on TCP/80 and TCP/443.

2. Authentication (Trigger): The attacker navigates to http://<vessel-ip>/ with a standard browser or automates the process with a script (Python requests / curl). The login page prompts for credentials. The attacker supplies the hardcoded default username, likely "admin" or "manufacturer" and the associated default password (often "admin", "1234", or a device-specific model string as published in service manuals sourced from leak sites or publicly available maintenance PDFs).

3. Access & Weaponization (Payload): Upon successful login with default credentials, the attacker accesses administrative functions of the web UI. Attackers have full read/write access, including:

   • Data Exfiltration: Downloading raw VDR data logs (containing up to 12+ hours of audio + positional data) via the "Export Data" or "Backup" function. Given a ship traversing a contested or high-value route, this is high-value intelligence.
   • Configuration Tampering: Modifying NTP (time synchronization) settings to skew recorded timestamps, or disabling recording channels (e.g., turning off the audio channel or radar capture) without triggering an immediate alarm that would alert crew.

4. Post-Exploitation (Impact): The attacker sets a new administrative password, locking out legitimate crew. They then delete or corrupt recent voyage data on the live storage, ensuring the pre-incident data is lost, and the vessel's VDR report for the period cannot be trusted. In more sophisticated scenarios, the attacker plants a web shell on the device's root filesystem on the SD card or internal flash, granting persistent remote access even after the default password is eventually changed (though it won't be — see Mitigation section).

Scenario B: Ship-to-Shore Lateral Movement

1. Initial Access: The attacker compromises the VDR via default credentials as above. The VDR G4e typically has a dual network interface — one connected to the vessel's navigational sensors (NMEA bus, Ethernet serial gateways) and one connected to the ship's IT network for remote fleet management (satellite link).

2. Pivot: From the VDR's IT-facing interface, the attacker scans the ship's subnet for other management systems: the bridge console (ECDIS), propulsion control system, or the crew's email/IT server. Since the VDR has legitimate connections to the vessel's network, its traffic is permitted by egress filtering — the attacker can use the VDR as a proxy or toolkit host to deploy a scan into the internal network.

3. Impact Amplification: The attacker identifies a connected chart plotter or navigation terminal with known older firmware (e.g., CVE-2026-XXXXX) and pivots to that host, potentially allowing course alteration or disabling of navigation displays during transit, a safety-critical outcome.

Impact Assessment

Business Impact: The primary business risk is regulatory and legal non-compliance. Maritime regulations (SOLAS V/20 and IMO guidelines) require VDR data to be preserved and tamper-proof. If the VDR is accessed and data is modified or deleted by a remote actor, the ship owner faces:

• Fines and detention at port (Port State Control).
• Erosion of insurance coverage for any incidents occurring during the tampered period; P&I clubs may repudiate claims.
• Criminal liability for crew members if the VDR tampering was not detected, leading to reputational damage of the operator.

Operational Impact: The vessel's entire voyage record is compromised, rendering accurate reconstruction of events impossible if an incident occurs during the tampered window. This impacts internal investigations, dispute resolution, and crew licensing.

Blast Radius: The vulnerability affects any Danelec MacGregor G4e unit on commercial vessels worldwide — estimated at thousands of installations across cargo, tanker, and passenger fleets. Each unit is a network pivot point inside a vessel. Exploitation also allows malicious data injection (fake GPS or sensor values) that could feed navigational equipment, though the attack surface for that is more constrained.

CVSS Breakdown: AV:N (remotely accessible) ACL: (no special conditions) PR:N, UI:N yields a broad attack surface. The subscores (C:H, I:L, A:L) reflect the disproportionate confidentiality damage (all data readable) relative to lower integrity/availability impacts — though the L for integrity is debatable given the regulatory weight of falsifying voyage data.

Criticality Note: While not in CISA KEV, the EPSS percentile of 13.4% indicates this is not currently a hot target in the wild, but the maritime sector is uniquely exposed due to the long fleet lifetime and infrequent firmware updates — a single unit may remain vulnerable for 5+ years.

Detection Guidance

Sigma Rule

Sigma rule to detect failed and successful login attempts with default known-usernames against a VDR G4e web interface (via webserver logs).

title: MacGregor VDR G4e Default Credential Login Attempt
id: e6a3f8c9-1f3b-4a7e-9c0d-3f5b7e8a1d9f
status: experimental
description: Detects login attempts to MacGregor VDR G4e web interface with known default usernames, indicating potential CVE-2026-42941 exploitation.
author: vartersit.com Threat Intel
date: 2026-02-18
logsource:
  category: webserver
  definition: 'Web access logs from the VDR device or a reverse proxy in front of it.'
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem:
      - '/login'
      - '/cgi-bin/login'
      - '/auth'
    cs-username|startswith:
      - 'admin'
      - 'factory'
      - 'supervisor'
      - 'vdr'
  condition: selection
falsepositives:
  - Legitimate factory maintenance using previously documented default credentials (rare, should be changed).
level: high

YARA Rule

YARA rule to scan forensic images or memory dumps of the VDR filesystem for the hardcoded credential patterns (strings).

rule MacGregor_VDR_G4e_Default_Credentials
{
    meta:
        author = "vartersit.com Threat Intel"
        description = "Detects hardcoded default credential patterns in MacGregor VDR G4e firmware firmware/web config"
        date = "2026-02-18"
        reference = "CVE-2026-42941"
        cve = "CVE-2026-42941"
        severity = "high"
    strings:
        $a = "DefaultPassword=" ascii wide
        $b = "AdminPassword=" ascii wide
        $c = "passwd=admin" ascii wide nocase
        $d = "user=admin" ascii wide nocase
        $e = "mt_username" ascii wide // factory OEM user
        $f = "g4e_default" ascii wide // possible config string
        $g = "MacGregor" and "VDR" ascii wide // firmware banner identifier
    condition:
        3 of them and $g // needs enough combined markers
}

Suricata IDS Rule

Suricata rule to detect network-level authentication attempts using known-weak credentials targeting the VDR web endpoint.

alert http any any -> $EXTERNAL_NET any (msg:"MACGREGOR VDR G4E Default Credential Login Attempt (CVE-2026-42941)"; flow:to_server,established; content:"POST"; http_method; http.uri; content:"/login"; http.uri; content:"admin"; http.client_body; nocase; content:"password"; http.client_body; nocase; depth:80; within:120; pcre:"/(admin|1234|vdr|default)/i"; classtype:attempted-admin; sid:2026042941; rev:1; reference:cve,CVE-2026-42941;)

Elastic Detection

Elastic EQL query to detect potential brute-force or direct attempts using default credential patterns in the network logs (here assuming logs from a shipboard firewall or the VDR web server).

network where network.transport == "tcp" and destination.port == 80 and
  (network.direction : ("inbound", "egress") and
   process.name : ("httpd", "VDRSvc.exe") and
   network.http_request.method == "POST" and
   network.http_request.body : ("*user=admin*", "*username=admin*", "*login=admin*"))

Splunk SPL Query

Splunk query to correlate repeated successful/failed logins from a single source IP to the VDR (based on Windows or Syslog events if a SIEM is deployed on board, or local web log collection).

index=* sourcetype=apache_access OR sourcetype=nginx OR sourcetype=vdr_webserver
| where method="POST" AND (uri="/login" OR uri="/cgi-bin/login" OR uri="/auth")
| eval is_default = if(match(username, "(?i)admin|factory|supervisor|vdr") OR match(form_data, "(?i)password=(admin|1234|vdr|default)"), "suspicious", "normal")
| stats count by src_ip, username, is_default, dest_ip
| where is_default="suspicious"
| sort - count

Wazuh OSSEC Rule

Wazuh local rule that triggers on a syslog/JSON event marking failed authentication against the VDR interface.

<group name="macgregor_vdr,">
  <rule id="100294" level="10">
    <decoded_as>json</decoded_as>
    <field name="device">MacGregor_VDR</field>
    <match>Login failure</match>
    <description>MacGregor VDR G4e: Failed login attempt to management interface — CVE-2026-42941 risk of default credentials.</description>
    <group>authentication_failed,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100295" level="12">
    <decoded_as>json</decoded_as>
    <field name="device">MacGregor_VDR</field>
    <match>Login success</match>
    <field name="srcip" type="ip">!127.0.0.0/8</field>
    <description>MacGregor VDR G4e: Successful remote login from unknown IP to management interface — validate user against approved IP whitelist.</description>
    <group>authentication_success,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment (2/4): The vendor (Danelec) has claimed a fix in firmware V5.250, but this has only been confirmed via the CNA advisory. The lack of a secondary source (e.g., official product bulletin with checksums or independent audit) means enterprise teams should perform their own verification after updating, including testing that the default credentials no longer work.

Immediate Mitigations (Before Patch):

1. Manual Credential Change (Mandatory): Immediate action: log into every G4e device with the factory credentials and set a unique, complex password. If the process is unknown, contact Danelec support for a manual credential reset procedure. This is the only effective immediate mitigation and addresses the root cause without firmware.
2. Network Isolation (ACL/Zone-based): If the VDR cannot be immediately accessed (e.g., vessel is at sea and no remote admin access is provisioned), enforce an access-control rule at the shipboard router/firewall that restricts access to the VDR management interface (default TCP/80,443) to only approved IP addresses on the bridge (e.g., the chief engineer's station). Block all inbound connections to the VDR from the satellite internet interface and from the passenger/crew LAN zones.
3. Vulnerability Scan: Use an internal scanner (e.g., Nessus or nmap) to enumerate all G4e instances and identify any instances accessible from the ship's WAN port. Flag any unit accessible from the internet as critical priority.
4. Intrusion Prevention: Write a custom IPS signature to detect login attempts with "default-ish" password strings as per the Detection Guidance above. Deploy on any shipboard NIDS or at the land-based fleet SOC.
5. Logging & Alerting: Enable logging of VDR management-interface login events, redirecting logs to the ship's SIEM (if available) or the fleet management system. Alert when any login is made from an IP not in the admin whitelist.

Patch/Upgrade Steps:

1. Evaluate Patch Integrity: Since patch confidence is 2/4, independently verify the firmware release: obtain SHA-256 checksums from Danelec support, download through a secured channel, verify against the published digest.
2. Upgrade Procedure: For vessels in port: schedule a maintenance window. Connect to the VDR's admin port (Ethernet) and upload the V5.250 firmware via the built-in web upload interface. For vessels at sea: determine if remote firmware upload is supported over VSAT; if so, execute in a low-traffic window. If not, plan for the next port call or annual service. Do not wait for the annual performance test — schedule dedicated service at the earliest berth.
3. Post-Patch Credential Check: After upgrade, verify that the default credentials are disabled by attempting to authenticate with them (expected to fail). Change the administrative password again post-upgrade, as firmware updates may revert configuration settings.
4. Re-verify: Check the device banner: if the web interface or CLI shows a version string lower than V5.250, the patch did not apply.

Long-Term Hardening:

1. Password Lifecycle Enforcement: If available (or via future firmware), enable password expiration (e.g., 90 days) and enforce complexity requirements. If the firmware does not support this, implement a manual policy tracked in the fleet's asset management system.
2. Firmware Update Program: Implement a company-wide policy for quarterly firmware reviews for all voyage data recorders, syncing with new vendor advisories.
3. Architecture Change: Segregate the VDR onto a dedicated industrial control network segment (VLAN) with a strictly controlled gateway to the office/IT LAN. The VDR should not be directly reachable from the satellite modem/router. Allow only SNMP read-only access (if needed for fleet monitoring) on a separate port, and terminate SSH/HTTPS admin sessions at the gateway.
4. Vessel Network Auditing: Perform an annual penetration test or at least a credentialed internal scan of the shipboard LAN to detect similar default credential issues in other navigation and communication equipment.
5. Credential Vault: Store unique VDR credentials in a password manager accessible only to senior marine officers, not in printed bridge manuals.

References

1. NVD Entry: NVD - CVE-2026-42941 (https://nvd.nist.gov/vuln/detail/CVE-2026-42941) — Official NVD record with CVSS v3.1 scoring and CWE-1392 classification.
2. Vendor Advisory (CNA — ICS-CERT): Advisory issued by icscert for Danelec MacGregor VDR G4e — Original security advisory detailing default credential issue and firmware V5.250 release. (Reference: ICS-CERT Advisory ID: 2026-155, February 2026).
3. Danelec Vendor Contact: Official vendor support page for firmware acquisition and technical guidance (https://www.danelec.com/contact).
4. CISA KEV (Not Listed): This CVE is not currently in CISA's Known Exploited Vulnerabilities catalog — status as of this writing. Monitor the KEV feed for updates if exploitation emerges.
5. MITRE ATT&CK: T1190 — Exploit Public-Facing Application (https://attack.mitre.org/techniques/T1190/) — Relevant tactic/technique for the exploitation route described.
6. EPSS Data: FIRST.org EPSS score for CVE-2026-42941 — Score 0.00226 (13.4% percentile) indicating low immediate exploitation likelihood (https://www.first.org/epss/).

Threat Actor/Campaign Evidence: As of this writing, no known threat group has publicly claimed exploitation of CVE-2026-42941, and no exploit code has been observed in the wild. However, the vessel data recording sector has seen past espionage campaigns (e.g., suspected nation-state interest in shipping routes), making proactive mitigation essential despite the low EPSS.