Is CVE-2026-40425 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40425 being exploited in the wild.

How severe is CVE-2026-40425?

High severity, with a CVSS score of 8.3, published 29 May 2026.

Is there a fix for CVE-2026-40425?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40425 attacked?

It is attacked from the adjacent network.

Am I affected by CVE-2026-40425?

Check whether you run Danelec VDR G4e at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40425: Danelec MacGregor VDR use of default credentials

CVE-2026-40425 · Severity: high · CVSS 8.3 · Published 2026-05-29

The Danelec MacGregor Voyage Data Recorder (VDR), a device used on maritime vessels to record critical voyage data, contains a default username and password that cannot be changed by the user. An attacker with access to the ship's local network could use these credentials to gain unauthorized administrative access to the device. This could allow them to tamper with recorded data, disrupt operations, or gain a foothold for further attacks on the vessel's systems.

Technologies: Danelec VDR G4e. Vendors: Danelec.

Quick answers

Is CVE-2026-40425 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40425 being exploited in the wild.
How severe is CVE-2026-40425?: High severity, with a CVSS score of 8.3, published 29 May 2026.
Which products and versions are affected?: Danelec VDR G4e < V5.250.
Is there a fix for CVE-2026-40425?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40425 attacked?: It is attacked from the adjacent network.
Am I affected by CVE-2026-40425?: Check whether you run Danelec VDR G4e at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Danelec MacGregor Voyage Data Recorder (VDR) G4e (versions prior to V5.250) is vulnerable to the use of default credentials (CWE-1392). The device ships with a default username and password that are not subject to an enforced change policy upon initial setup. An attacker with adjacent network access can authenticate to the device without prior authorization. Successful exploitation grants the attacker administrative privileges, enabling them to modify configurations or access sensitive voyage data. This vulnerability is part of a larger set of credential-related issues (including hard-coded accounts and insecure password hashing) addressed in firmware version V5.250.

Affected products

Danelec MacGregor Voyage Data Recorder (VDR) G4e < V5.250

Identifiers

CVE-2026-40425
CVE-2026-44611
CVE-2026-42929
CVE-2026-42951
CVE-2026-42941

Timeline

2026-05-28: advisory: CISA published advisory ICSA-26-148-01
2026-05-29: disclosed: CVE-2026-42941 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.