CVE-2026-42951

Executive Summary

CVE-2026-42951 is an insufficiently protected credentials vulnerability (CWE-522) affecting the Danelec MacGregor Voyage Data Recorder (VDR) G4e maritime navigation system. An authenticated user with low-privilege access can download a device backup file containing plaintext account data and password hashes, leading to full credential disclosure and potential lateral movement within maritime operational technology networks. The vulnerability carries a CVSS score of 5.4 (Medium severity) with a high confidentiality impact, and while no public exploit code exists, the attack complexity is low, making this a realistic target for insider threats and nation-state maritime espionage actors. Danelec has released firmware version V5.250 to address this issue, though patch confirmation is limited to a single source.

Technical Analysis

The vulnerability resides in the backup and recovery functionality of the MacGregor Voyage Data Recorder (VDR) G4e, a maritime data acquisition system manufactured by Danelec Marine. The VDR G4e is designed to continuously record voyage data—including navigation parameters, bridge audio, radar images, and ship operational telemetry—to comply with International Maritime Organization (IMO) regulations under SOLAS Chapter V.

Vulnerability Mechanism:

The core flaw is rooted in the device's backup export feature. When an authenticated user initiates a backup operation through the device's web-based management interface, the system generates an archive file containing the full device configuration state. Critically, this archive includes:

• User account names and associated metadata
• Password hashes for all configured accounts (including administrative accounts)
• In some instances, plaintext credential material for external service integrations (e.g., NTP, email relay, or remote monitoring connections)

The vulnerability is classified as CWE-522 (Insufficiently Protected Credentials) because the backup archive is either unencrypted, encrypted with a static/derivable key, or protected only by the same low-privilege authentication required to initiate the backup. The device fails to apply additional cryptographic protection or access control separation between the backup function and the sensitive credential material contained within.

Attack Surface:

The affected interface is the VDR G4e web management console, which listens on standard HTTP/HTTPS ports (typically 80/443). The attack surface includes:

• Any network-accessible instance of the VDR management interface (ship LAN, satellite WAN connections, or remote monitoring VPN links)
• Any authenticated user account, regardless of privilege level (operator, technician, or administrator)
• The backup download endpoint, accessible via direct HTTP request or through the UI

Technical Specifics:

From a code perspective, the flaw likely manifests as a missing access-control check on the backup endpoint combined with inadequate encryption of the archive contents. The backup generation function (e.g., generate_backup()) gathers system state including the user authentication database (/etc/passwd equivalent or custom credential store) without sanitizing or separately encrypting the credential material. The resulting archive is then made available for download with only the standard session cookie check—no additional verification that the requesting user has administrative privileges or that the archive contents meet minimum protection standards.

The password hashing scheme is believed to be unsalted or weakly salted (e.g., MD5, SHA-1, or a proprietary hash), making offline brute-force and rainbow table attacks practical once the archive is obtained. This elevates the impact beyond simple credential disclosure to practical account takeover for administrative accounts.

Exploitation Scenarios

Attack Chain — Insider Threat / Compromised Low-Privilege Account:

1. Reconnaissance & Target Identification:

   • The attacker identifies a target vessel or fleet using SHODAN or maritime-specific search engines with dorks such as product:"Danelec VDR" or "MacGregor VDR G4e" http.title:"login".
   • Alternatively, an insider (crew member, contractor with basic operator credentials) identifies the VDR management interface on the ship's LAN (typically 192.168.x.x or 10.x.x.x ranges).
   • The attacker performs a port scan on the target host to confirm HTTP/HTTPS management interface availability.

2. Authentication:

   • The attacker uses valid low-privilege credentials (operator-level account) obtained through social engineering, credential theft from a previous engagement, or legitimate access as a crew member.
   • Login is performed via POST /login with standard form credentials.

3. Backup Trigger & Download:

   • The attacker navigates to the backup/export function, identified through standard enumeration: GET /backup, GET /export, or GET /system.backup.
   • Alternatively, the attacker directly requests the known backup endpoint without UI navigation: GET /cgi-bin/backup.cgi?action=download or POST /backup/generate.
   • If endpoint discovery is required, the attacker fuzzes common paths: /backup, /backups, /export, /download, /config.bin, /archive.
   • The server responds with a file (e.g., vdr_backup_2026_MM_DD.tar.gz) containing the full system configuration.

4. Credential Extraction:

   • The attacker extracts the archive locally: tar -xzf vdr_backup_2026_MM_DD.tar.gz.
   • Inside, they locate the credential database file (e.g., etc/shadow, users.db, auth.conf).
   • Password hashes are extracted: grep -E '^(admin|root|service):' users.db.
   • Using offline cracking tools (Hashcat, John the Ripper), the attacker cracks weak/unsalted hashes:

     hashcat -m 0 -a 0 admin_hash.txt rockyou.txt
     

   • Plaintext credentials for service accounts (e.g., email relay, remote monitoring) are obtained directly if stored in plaintext.

5. Post-Exploitation:

   • The attacker logs in with administrative credentials, gaining full control over the VDR device.
   • The attacker can:
     • Modify/delete voyage data logs to cover their tracks or facilitate cargo theft
     • Disable alarm systems
     • Plant persistent backdoor accounts for future access
     • Use the VDR as a pivot point into the ship's broader OT network (navigation systems, engine controls, cargo management)
     • Exfiltrate sensitive voyage data (routes, cargo manifests, crew manifests) for competitive advantage or maritime intelligence purposes

Alternative Scenario — Remote Attack on Fleet Management Infrastructure:

1. Many shipping companies expose VDR management interfaces through satellite VPN links or remote monitoring services for fleet oversight.
2. An attacker who compromises a fleet management account (via phishing or credential stuffing) can iterate across all connected VDR instances, harvesting credentials from each.
3. This creates a domino effect: each compromised VDR yields additional credentials that may grant access to other vessel systems or shore-based infrastructure.

Impact Assessment

CVSS Breakdown:

• Attack Vector: Network (AV:N) — The vulnerability is exploitable over the network via the management interface, including remote access pathways.
• Attack Complexity: Low (AC:L) — No special conditions or race conditions required; the backup endpoint is straightforward to invoke.
• Privileges Required: Low (PR:L) — Only low-privilege authentication is needed.
• User Interaction: None (UI:N) — No victim interaction required.
• Confidentiality Impact: High (C:H) — Full credential database disclosure, including administrative and service account credentials.
• Integrity Impact: None (I:N) — The vulnerability itself does not directly allow data modification.
• Availability Impact: None (A:N) — No direct denial-of-service capability.

Business Impact:

• Regulatory Non-Compliance: IMO SOLAS and ISPS Code requirements mandate the integrity and controlled access of VDR data. A successful credential compromise that allows data manipulation or destruction can result in regulatory penalties and flag-state sanctions.
• Maritime Security: Compromised VDR credentials can be leveraged to tamper with voyage records, potentially enabling fraudulent insurance claims, smuggling operations, or evading port-state control inspections.
• Operational Disruption: Attackers with admin access can disable the VDR entirely, violating mandatory carriage requirements and potentially grounding the vessel.
• Supply Chain Risk: The VDR is a component of the broader maritime OT environment. Credential reuse between shipboard systems (NMEA network, ECDIS, radar) can enable lateral movement to safety-critical systems.

Blast Radius:

• Directly affected: All MacGregor VDR G4e devices running firmware prior to V5.250.
• Indirectly affected: Any system sharing credentials with the compromised VDR accounts, including shore-based fleet management platforms, email/communication systems, and remote monitoring services.
• Given the global shipping fleet, thousands of vessels may be exposed, with concentrated risk in major shipping regions (Singapore, Greece, Japan, Germany, Panama-flagged vessels).

Detection Guidance

Sigma Rule

title: Suspicious VDR Backup Download - CVE-2026-42951
status: experimental
description: Detects attempts to download configuration backups from Danelec MacGregor VDR G4e management interfaces, potentially indicating exploitation of CVE-2026-42951.
author: valtersit.com Threat Intelligence
date: 2026/02/15
logsource:
  category: webserver
  product: apache
  definition: 'Web server logs for Danelec MacGregor VDR G4e management interface'
detection:
  selection_backup_paths:
    cs-uri-path:
      - '*backup*'
      - '*export*config*'
      - '*download*backup*'
      - '*vdr_archive*'
      - '*.tar.gz'
  selection_file_extensions:
    cs-uri-query:
      - '*action=download*'
      - '*format=backup*'
  selection_low_privilege:
    cs-username:
      - 'operator*'
      - 'technician*'
      - 'user*'
  condition: selection_backup_paths and selection_file_extensions and selection_low_privilege
  timeframe: 5m
falsepositives:
  - Legitimate administrator performing scheduled backups
  - Authorized maintenance personnel exporting configuration
  - Automated fleet management systems pulling backups
level: medium
tags:
  - attack.t1003
  - attack.t1213
  - cve.2026-42951
  - cwe.522

YARA Rule

rule CVE_2026_42951_VDR_Credential_Backup
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects files resembling Danelec MacGregor VDR G4e backup archives containing credential material"
        date = "2026-02-15"
        cve = "CVE-2026-42951"
        severity = "medium"
    strings:
        $cred_db = "users.db" ascii wide nocase
        $shadow_alt = "auth.conf" ascii wide nocase
        $vdr_id = "MacGregor" ascii wide nocase
        $vdr_id2 = "Danelec" ascii wide nocase
        $vdr_id3 = "VDR-G4e" ascii wide nocase
        $hash_pattern = /[a-f0-9]{32}/ ascii
        $salt_pattern = /[a-zA-Z0-9$]{10,}\$[a-f0-9]{32,}/ ascii
        $tar_magic = { 1F 8B 08 00 } // gzip magic
    condition:
        (uint32(0) == 0x8B1F0008 or $tar_magic) and
        (any of ($cred_db, $shadow_alt)) and
        (any of ($vdr_id, $vdr_id2, $vdr_id3)) and
        (any of ($hash_pattern, $salt_pattern))
}

Suricata IDS Rule

alert http any any -> $VDR_NET any (
    msg:"ET EXPLOIT Danelec MacGregor VDR G4e Backup Download Attempt (CVE-2026-42951)";
    flow:established,to_server;
    http.method:"GET";
    http.uri;
    content:"/backup";
    http.uri;
    content:"/export";
    http.uri;
    content:"/download";
    http.uri;
    content:".tar.gz";
    http.response_code:200;
    http.response_body;
    content:"users.db";
    http.response_body;
    content:"Danelec";
    reference:cve,2026-42951;
    reference:url,https://www.danelec.com/contact;
    classtype:attempted-user;
    sid:202602151;
    rev:1;
    metadata:created_at 2026_02_15, updated_at 2026_02_15;
)

Elastic Detection

// Detect VDR backup file downloads followed by unusual offshore data exfiltration patterns
sequence by source.ip with maxspan=1h
  [network where destination.port in (80, 443) and
     url.path in ("/backup", "/export", "/download") or
     url.path like "*backup*" and
     url.path like "*.tar.gz*"]
  [file where event.action == "open" and
     file.extension == "tar.gz" and
     process.name in ("tar", "7z", "winrar", "explorer.exe")]
  [network where destination.ip not in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") and
     destination.port in (21, 22, 80, 443, 8080)]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*backup*" OR uri_path="*export*" OR uri_path="*download*"
| search uri_path="*.tar.gz*" OR uri_query="*action=download*"
| eval is_vdr=if(match(uri_path, "vdr|macgregor|danelec"), 1, 0)
| where is_vdr=1 OR (match(uri_path, "backup") AND status=200 AND bytes>10000)
| stats count BY src_ip, dest_ip, uri_path, uri_query, user, status
| sort -_time
| rename src_ip AS "Source IP", dest_ip AS "Destination IP", uri_path AS "Requested Path", 
         uri_query AS "Query String", user AS "Authenticated User", status AS "HTTP Status"
| table _time "Source IP" "Destination IP" "Requested Path" "Query String" "Authenticated User" "HTTP Status" count

Wazuh OSSEC Rule

<group name="cve-2026-42951,">
  <!-- Detect VDR backup endpoint access from low-privilege accounts -->
  <rule id="100251" level="10">
    <decoded>
      <field name="url">\.(tar|gz|zip)($|\?)</field>
    </decoded>
    <field name="url">backup</field>
    <field name="http_user_agent">\.|Mozilla|curl|wget</field>
    <description>CVE-2026-42951: VDR backup download attempt from non-admin user account</description>
    <group>authentication_success,</group>
    <mitre>
      <id>T1003</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <!-- Detect access to credential database files -->
  <rule id="100252" level="12">
    <decoded>
      <field name="url">\.(db|conf)($|\?)</field>
    </decoded>
    <field name="url">auth</field>
    <description>CVE-2026-42951: Access to credential database file on VDR system</description>
    <group>authentication_success,</group>
    <mitre>
      <id>T1003</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — single source (CNA) claims patch, not independently confirmed.

1. Immediate Mitigations (before patching):

   • Restrict network access to the VDR management interface to authorized maintenance personnel only. Implement firewall rules limiting source IPs to management VLANs and known shore-based support networks.
   • Enforce strong, unique passwords for all VDR accounts. Ensure no default or factory credentials remain in use.
   • Implement two-factor authentication (2FA) for all VDR administrative access if supported by the device firmware or through an external authentication proxy.
   • Disable remote management access (internet-facing exposure) unless absolutely required; if required, restrict via VPN with mutual authentication.
   • Monitor VDR access logs for unusual backup download activity, especially from low-privilege accounts.
   • Rotate all credentials stored within the VDR (e.g., email relay passwords, remote monitoring tokens) as a precaution, since they may have been previously exposed.

2. Patch/Upgrade Steps:

   • Upgrade the MacGregor Voyage Data Recorder (VDR) G4e firmware to version V5.250 as released by Danelec.
   • Schedule the firmware update at the earliest possible service attendance. Do not defer the update until the next annual performance test.
   • Before applying the firmware update, verify checksums of the update package against Danelec-provided hashes.
   • After upgrade, verify that the vulnerability is resolved by attempting to download a backup as a low-privilege user and confirming the archive does not contain credential material or that additional authorization is required.
   • Contact Danelec via https://www.danelec.com/contact for detailed upgrade instructions, compatibility notes, and any supplementary patches.

3. Long-Term Hardening:

   • Segment the VDR and related maritime OT systems onto a dedicated network segment with strict egress/ingress controls.
   • Implement an enterprise credential management solution for all OT device accounts, ensuring unique credentials and automated rotation.
   • Deploy centralized logging and SIEM integration for all VDR management activities, with alerting on backup downloads, authentication anomalies, and configuration changes.
   • Conduct regular security assessments of shipboard OT environments, including penetration testing of network-connected maritime systems.
   • For security teams managing fleet infrastructure, inventory all VDR G4e devices and enforce a minimum firmware standard across the fleet.
   • Monitor Danelec Security Advisories and the CISA KEV catalog for updates on CVE-2026-42951 or related VDR vulnerabilities.

References

1. NVD Entry — CVE-2026-42951: https://nvd.nist.gov/vuln/detail/CVE-2026-42951
2. Danelec Marine — Product Contact & Support: https://www.danelec.com/contact
3. ICS-CERT Advisory (CNA) — CVE-2026-42951, MacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected Credentials (referenced via NVD)
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-42951 not currently listed)
5. MITRE ATT&CK Technique T1003 — OS Credential Dumping: https://attack.mitre.org/techniques/T1003/ (relevant for detection and threat modeling context)

Threat Actor Intelligence Notes: As of the publication date, there are no known threat actor campaigns or indicators of exploitation in the wild associated with CVE-2026-42951. The CISA KEV catalog does not currently list this vulnerability. However, given the maritime sector is a known target for nation-state espionage (e.g., activities attributed to Chinese, Russian, and North Korean APT groups against shipping and port infrastructure), the vulnerability represents a realistic vector for credential harvesting in targeted maritime campaigns. The public availability of the vulnerability details and its low exploitation complexity increase the likelihood of future weaponization. Security teams in the maritime sector should treat this as an active threat surface and prioritize patching accordingly.