CVE-2026-42941 describes a security vulnerability in the Danelec MacGregor Voyage Data Recorder (VDR) G4e where the device ships with a default username and password that users are not required to change. This lack of enforced credential change allows attackers with network access to authenticate with low complexity and gain high-impact access to the device. The CVSS 3.1 vector indicates the attack requires adjacent network access, no privileges or user interaction, and impacts confidentiality, integrity, and availability significantly. No patch or official remediation level has been published by the vendor as of the data provided.

An attacker with access to the network segment adjacent to the device can authenticate using default credentials, leading to full compromise of confidentiality and integrity of the voyage data recorder, and partial impact on availability. This could allow unauthorized data access, manipulation, or disruption of device functions critical to maritime operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to change default credentials manually if possible and restrict network access to the device to trusted entities only. Monitor vendor communications for updates on patches or official mitigations.