Cyber Resilience

CVE-2026-42951

Exposed Creds in Macgregor Interschalt Vdr G4E Firmware ≤ 5.250

Published
29 May 2026
Modified
21 July 2026
Patch / advisory
CVSS Score v4 5.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0017 7th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-42951 is a medium-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Macgregor Interschalt Vdr G4E Firmware. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
Why these techniques?

Authenticated backup download directly exposes stored password hashes (CWE-522), mapping to Credentials In Files.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-40425Same product: Macgregor Interschalt Vdr G4E
CVE-2026-42929Same product: Macgregor Interschalt Vdr G4E
CVE-2026-44611Same product: Macgregor Interschalt Vdr G4E
CVE-2026-42941Same product: Macgregor Interschalt Vdr G4E
CVE-2024-34885Shared CWE-522
CVE-2025-62794Shared CWE-522
CVE-2025-63361Shared CWE-522
CVE-2024-34883Shared CWE-522
CVE-2026-59891Shared CWE-522
CVE-2024-34887Shared CWE-522

Affected Assets

macgregor
interschalt vdr g4e firmware
≤ 5.250

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-6 Least Privilege
  • AC-3 Access Enforcement
  • SC-28 Protection of Information at Rest
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V11.3.3

Mitigating Controls (NIST 800-53 r5) AI

prevent

Least privilege directly stops non-administrative authenticated users from obtaining device backups that contain account data and password hashes.

prevent

Access enforcement can restrict the backup-download capability to only those roles explicitly authorized to handle credential material.

prevent

Protection of information at rest requires password hashes and account data inside backups to be encrypted or otherwise safeguarded against unauthorized disclosure.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 full match
prevents

Encrypting data-at-rest fully prevents insecure credential storage while only partially satisfying the broader data-protection outcome.

PR.DS-02 full match
prevents

Encrypting data-in-transit fully prevents interception of credentials in motion while only partially satisfying the broader data-protection outcome.

PR.AA-01 mostly match
prevents

Credential management practices directly reduce insecure storage/transmission but do not guarantee encryption or transport protection.

PR.AA-04 mostly match
prevents

Protecting identity assertions covers conveyance of credentials but is narrower than full credential lifecycle protection.

PR.AA-03 partial match
prevents

Authentication policies can enforce stronger credential handling yet address only verification, not storage or transit protection.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requiring protected storage, transmission, and non-display of passwords prevents credentials from being stored or sent in clear text where they can be harvested by unauthorized actors.

prevents

Protecting secret and private keys against disclosure and unauthorized use decreases the exposure of credentials that are stored or transmitted in recoverable form.

prevents

Forbidding clear-text transmission and display of passwords, plus the use of stronger alternatives to passwords, prevents credentials from being obtained or reused by attackers.

prevents

Acceptable-use expectations that cover protection of credentials and information assets throughout their lifecycle discourage practices that expose or mishandle authentication material.

prevents

Contractual clauses that survive termination help ensure that credentials and other secrets are not retained or misused after employment ends.

prevents

Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.

References