# CVE-2026-42929: Danelec MacGregor Voyage Data Recorder hard-coded credentials

Source: https://junglewise.ai/threats/cve-2026-42929-danelec-macgregor-voyage-data-recorder-hard-coded-credentials  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-42929 · Severity: high · CVSS 8.3 · Published 2026-05-29

Danelec MacGregor Voyage Data Recorders, which function like 'black boxes' for maritime vessels to record navigation and sensor data, contain default accounts with hard-coded passwords. An attacker with access to the ship's local network could use these credentials to gain unauthorized access to the device. This could allow them to tamper with recorded voyage data or disrupt the operation of critical maritime safety equipment.

Vendors: [Danelec](https://junglewise.ai/threats/vendors/danelec).

## Quick answers

**Is CVE-2026-42929 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42929 being exploited in the wild.

**How severe is CVE-2026-42929?** High severity, with a CVSS score of 8.3, published 29 May 2026.

**Which products and versions are affected?** Danelec Voyage Data Recorder G4e < V5.250.

**Is there a fix for CVE-2026-42929?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42929 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-42929?** Check whether you run Danelec Voyage Data Recorder G4e at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MacGregor Voyage Data Recorder (VDR) G4e contains a vulnerability classified as Use of Hard-coded Credentials (CWE-798). The device includes default accounts with credentials that are hard-coded into the firmware and cannot be changed by the user. An attacker with adjacent network access (e.g., on the same vessel network) can use these credentials to authenticate to the device without prior authorization. Successful exploitation grants the attacker administrative access, enabling them to modify sensitive configuration files, access recorded data, or impact the availability of the VDR. This issue is resolved in firmware version V5.250.

## Affected products

- Danelec MacGregor Voyage Data Recorder (VDR) G4e < V5.250

## Timeline

- 2026-05-28: advisory: CISA published advisory ICSA-26-148-01
- 2026-05-29: disclosed: CVE-2026-42929 published to NVD

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-01.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01](https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01)
- [https://www.danelec.com/contact](https://www.danelec.com/contact)