The administrator account for the

Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.

The administrator account for the

Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.

The VDR device includes a default username and password, with no enforced password change. An authenticated user can download a backup of the device which includes account data and password hashes. Passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks. The device includes default accounts with hard-coded credentials. The administrator account for the web interface can directly edit sensitive files related to authentication, potentially changing the root password.