CVE-2026-40425
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The administrator account of the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive authentication files, potentially changing the root password.
Risk Assessment
An attacker with administrator access can change the root password, gaining full control over the device and its recorded data.
Recommendation
Restrict administrator account access to trusted personnel and implement monitoring of authentication file changes.
Other vulnerabilities in Danelec MacGregor Voyage Data Recorder
See all- CVE-2026-44611Medium
In Danelec MacGregor Voyage Data Recorder, passwords are stored with a hashing method that limits password length and is susceptible to brute force attacks.
- CVE-2026-42951Medium
An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device, which includes account data and password hashes.
- CVE-2026-42941High
The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.
- CVE-2026-42929High
The Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.
Original NVD description (English source)
The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.