Danelec MacGregor Voyage Data Recorder Password Hashing Vulnerability Allowing Brute Force Attacks

A vulnerability exists in the Danelec MacGregor Voyage Data Recorder (VDR) G4e, in versions prior to V5.250, where passwords are hashed using a method that restricts password length and is vulnerable to brute force attacks. This flaw could potentially allow an attacker to gain unauthorized access to the device by exploiting the weak password hashing mechanism.

Impact

Exploitation of this vulnerability could lead to unauthorized administrator access on the affected device.

Remediation

Danelec has released firmware version V5.250 to address this vulnerability. Users are encouraged to update their MacGregor Voyage Data Recorder (VDR) G4e devices at the earliest service opportunity. For additional questions, contact Danelec through their website.