CVE-2026-42941 identifies a security vulnerability in the Danelec MacGregor Voyage Data Recorder (VDR) G4e where the device ships with a default username and password that users are not required to change. This lack of enforced credential change allows potential unauthorized access to the device. The vulnerability is classified under CWE-1392. The CVSS v3.1 base score is 8.3, reflecting high impact on confidentiality, integrity, and low impact on availability, with attack vector being adjacent network and no privileges or user interaction required.

Successful exploitation of this vulnerability could allow an attacker with adjacent network access to gain unauthorized access to the VDR device, potentially compromising sensitive voyage data and affecting data integrity and availability. The high CVSS score indicates a serious risk to confidentiality and integrity of the device's data.

No official patch or remediation level has been published by the vendor as of now. Since the vulnerability involves default credentials with no enforced password change, it is recommended to check the vendor advisory for updates. Until an official fix or guidance is provided, operators should consider restricting network access to the device and monitoring for unauthorized access attempts. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.