This vulnerability (CVE-2026-42951) affects the Danelec MacGregor Voyage Data Recorder (VDR) G4e. It allows an authenticated user to download a backup file from the device, which includes sensitive account data and password hashes. The CVSS v3.1 base score is 5.4 (medium), reflecting that the attack requires local or adjacent network access (Attack Vector: Adjacent), high attack complexity, and low privileges but no user interaction. The confidentiality impact is high due to exposure of account credentials, integrity impact is low, and availability is not affected. No patch or official remediation level has been published as of the current data.

The vulnerability exposes sensitive account data and password hashes to any authenticated user who can access the device backup functionality. This could facilitate credential compromise and unauthorized access escalation if the hashes are cracked. However, exploitation requires prior authentication and high attack complexity, limiting immediate risk. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to the device and monitor for unauthorized backup downloads. Follow any vendor recommendations once published.