This vulnerability (CVE-2026-40425) affects the Danelec MacGregor Voyage Data Recorder (VDR) G4e. It involves CWE-552, where the administrator account on the web interface can directly modify sensitive files related to authentication, potentially allowing changes to the root password. The CVSS 3.1 base score is 5.7 (medium), with attack vector as adjacent network, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact. No patch or official remediation level has been published by the vendor. The vulnerability was published on May 29, 2026, and no known exploits have been reported.

If exploited, this vulnerability could allow an attacker with administrator access to the web interface to change the root password by editing sensitive authentication files. This could lead to unauthorized root-level access, compromising confidentiality and potentially affecting availability. The integrity impact is rated low, indicating limited ability to modify data beyond authentication files. The vulnerability requires high privileges (administrator access) and is exploitable over an adjacent network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates. Until a patch is available, restrict administrator access to the web interface to trusted personnel and networks only. No additional vendor-provided mitigations are currently documented.