# CVE-2026-44611: Danelec MacGregor VDR weak password hashing

Source: https://junglewise.ai/threats/cve-2026-44611-danelec-macgregor-vdr-weak-password-hashing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-44611 · Severity: medium · CVSS 5.4 · Published 2026-05-29

The Danelec MacGregor Voyage Data Recorder (VDR), which functions as a 'black box' for maritime vessels, uses an insecure method for storing user passwords. This flaw allows an attacker with access to the ship's local network to potentially crack user passwords through automated guessing. If successful, an attacker could gain unauthorized access to the device, compromising the integrity of recorded voyage data.

Technologies: [Danelec VDR G4e](https://junglewise.ai/threats/technologies/vdr-g4e). Vendors: [Danelec](https://junglewise.ai/threats/vendors/danelec).

## Quick answers

**Is CVE-2026-44611 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44611 being exploited in the wild.

**How severe is CVE-2026-44611?** Medium severity, with a CVSS score of 5.4, published 29 May 2026.

**Which products and versions are affected?** Danelec VDR G4e < V5.250.

**Is there a fix for CVE-2026-44611?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44611 attacked?** It is attacked from the adjacent network, in device firmware.

**Am I affected by CVE-2026-44611?** Check whether you run Danelec VDR G4e at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability (CWE-916) exists in the password storage mechanism of the MacGregor VDR G4e. The device utilizes a hashing algorithm that imposes a maximum password length and lacks sufficient computational complexity, making it susceptible to offline brute-force or dictionary attacks. An attacker who has already obtained password hashes (e.g., via CVE-2026-42951) and has adjacent network access can exploit this to recover plaintext credentials. This issue is resolved in firmware version V5.250.

## Affected products

- Danelec MacGregor Voyage Data Recorder (VDR) G4e < V5.250

## Timeline

- 2026-05-28: advisory: CISA ICSA-26-148-01 published
- 2026-05-29: disclosed: CVE-2026-44611 published to NVD

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-01.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-01.json)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01](https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01)
- [https://www.danelec.com/contact](https://www.danelec.com/contact)

## Related threats

- [Danelec MacGregor VDR credential exposure in device backup](https://junglewise.ai/threats/cve-2026-42951-danelec-macgregor-vdr-credential-exposure-in-device-backup)
- [Danelec MacGregor VDR use of default credentials](https://junglewise.ai/threats/cve-2026-42941-danelec-macgregor-vdr-use-of-default-credentials)
- [Danelec MacGregor VDR G4e File Access in Web Interface](https://junglewise.ai/threats/cve-2026-40425-danelec-macgregor-vdr-g4e-file-access-in-web-interface)