Danelec MacGregor Voyage Data Recorder Default Credentials Vulnerability

A vulnerability exists in the Danelec MacGregor Voyage Data Recorder (VDR) G4e devices prior to version 5.250, allowing for unauthorized access due to the presence of default usernames and passwords, with no requirement for users to change them. This issue is compounded by the device's web interface, which permits direct editing of sensitive authentication-related files, potentially enabling unauthorized password changes.

Impact

Exploitation of this vulnerability could lead to unauthorized administrator access on the affected device.

Remediation

Danelec has released firmware version 5.250 to address this vulnerability. Users are advised to update their devices at the earliest opportunity. For more information, contact Danelec through their website.