CVE-2026-40425

EUVD-2026-33403 · Published May 29, 2026

The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.

Technologies

Macgregor Interschalt Vdr G4E FirmwareMacgregor Interschalt Vdr G4E

Weaknesses

CWE-552

CVSS scores

v4.06.9CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
v3.14.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01
https://www.danelec.com/contact

Potentially impacted assets

See if this affects your attack surface