{"id":"CVE-2026-44611","state":"PUBLISHED","title":"MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational Effort","description":"Danelec MacGregor Voyage Data Recorder\npasswords are stored with a hashing method which limits password length and is susceptible to brute force attacks.","publishedAt":"2026-05-29T17:42:15.577Z","updatedAt":"2026-05-29T19:44:47.782Z","severity":{"score":5.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Danelec MacGregor Voyage Data Recorder (VDR) G4e"],"affected":[{"vendor":"Danelec","product":"MacGregor Voyage Data Recorder (VDR) G4e","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.250","versionType":"custom"}]}],"references":["https://www.danelec.com/contact","https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01","https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-01.json"],"weaknesses":["CWE-916"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/44xxx/CVE-2026-44611.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-44611","state":"PUBLISHED","datePublished":"2026-05-29T17:42:15.577Z","dateUpdated":"2026-05-29T19:44:47.782Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2026-05-07T16:55:26.109Z"},"containers":{"cna":{"title":"MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational Effort","descriptions":[{"lang":"en","value":"Danelec MacGregor Voyage Data Recorder\npasswords are stored with a hashing method which limits password length and is susceptible to brute force attacks."}],"affected":[{"vendor":"Danelec","product":"MacGregor Voyage Data Recorder (VDR) G4e","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"5.250","versionType":"custom"}]}],"references":[{"url":"https://www.danelec.com/contact"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-148-01"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-148-01.json"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":5.4,"vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.9,"vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-916","lang":"en","description":"CWE-916 Use of Password Hash With Insufficient Computational Effort","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2026-05-29T17:42:15.577Z"},"datePublic":"2026-05-28T17:22:00.000Z","solutions":[{"lang":"en","value":"Danelec has released firmware version V5.250 to resolve these vulnerabilities. Users of MacGregor Voyage Data Recorder (VDR) G4e devices are encouraged to update the firmware at the earliest service attendance rather than waiting for an annual performance test. Contact Danelec with additional questions:  https://www.danelec.com/contact","supportingMedia":[{"type":"text/html","base64":false,"value":"<span>Danelec has released firmware version V5.250 to resolve these vulnerabilities. Users of MacGregor Voyage Data Recorder (VDR) G4e devices are encouraged to update the firmware at the earliest service attendance rather than waiting for an annual performance test. Contact Danelec with additional questions:&nbsp;</span><a href=\"https://www.danelec.com/contact\">https://www.danelec.com/contact</a>"}]}],"credits":[{"lang":"en","value":"Andrew Tierney of Pen Test Partners reported these vulnerabilities to CISA.","type":"finder"}],"source":{"advisory":"ICSA-26-148-01","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-29T19:44:32.498800Z","id":"CVE-2026-44611","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-29T19:44:47.782Z"}}]}}}