Raw vector
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-44611 is a medium-severity Use of Password Hash With Insufficient Computational Effort (CWE-916) vulnerability in Macgregor Interschalt Vdr G4E Firmware. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Cracking (T1110.002); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-33398
Vulnerability Data
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Explicit mention of weak hashing limiting password length and enabling brute force directly maps to password cracking technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires organizations to manage authenticators using approved cryptographic methods that resist brute-force attacks, addressing the weak password hashing in the VDR.
Mandates cryptographic protection of information at rest, directly mitigating exposure of password hashes stored with insufficient strength.
Requires use of approved cryptographic algorithms and key lengths, which would preclude the weak hashing algorithm described in the CVE.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper password hashing is a direct instance of using cryptographic hashes to protect data-at-rest.
Secure development practices explicitly include selection and configuration of strong, computationally expensive password hashes.
Authentication policies may reference password handling but do not address storage or computational cost of hashes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure handling of authentication information, which includes choosing strong password hashing schemes.
Requires appropriate use of cryptography, which encompasses selecting strong hashing algorithms for passwords.
Secure coding practices include implementing password storage with adequate computational effort.
Mandates secure authentication mechanisms, directly addressing the need for computationally strong password hashes.