Signal K Server
CVE-2025-66398
HIGH
GHSA-w3x5-7c4c-66p9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach Signal K server over network
-
DeliveryUpload malicious zip to unauthenticated /validateBackup
-
ExploitPollute global restoreFilePath
-
InstallAdmin triggers Restore, unzips attacker files
-
C2Overwrite security.json to add rogue admin
-
ExecuteInject command via App Store install
-
ImpactExecute arbitrary commands on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication required to pollute server state: the /skServer/validateBackup endpoint lacks authentication middleware and uses a shared module-global restoreFilePath, so any network-reachable attacker can set it. Full RCE requires the admin 'Restore' function (/skServer/restore) to then execute against the polluted path - hence CVSS UI:R - and the final code execution leverages a separate App Store install command-injection path. Limiting factors: the server must be network-reachable (the vendor explicitly flags Internet-exposed instances); reliable RCE depends on the Restore workflow being invoked; and the affected product is a niche marine application with small deployment. All versions prior to 2.19.0 are affected; 2.19.0 patches it. |
| Impact | This is a genuinely high-priority flaw where multiple signals mostly align. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) is corroborated by the GitHub Security Lab advisory and the code-level root-cause analysis: an unauthenticated, network-reachable endpoint (/skServer/validateBackup) with no auth middleware pollutes module-global state, chaining to full account takeover and RCE. A complete working Python PoC is published in the GHSA advisory, so exploitation is well understood and low-effort. The one tempering signal is EPSS, at just 0.10% (27th percentile), and there is NO CISA KEV listing - indicating no observed mass exploitation yet, consistent with the product's small, niche footprint (marine boat servers) rather than any weakness in the vulnerability itself. The release note explicitly warns Internet-exposed servers to patch ASAP. One nuance to verify: the vendor assigned UI:R because reliable RCE depends on the admin's 'Restore' function being triggered; an unauthenticated attacker pollutes state freely, but the destructive restore step is typically admin-initiated (or requires the attacker to already reach /restore). Treat this as high real risk for any Internet-exposed Signal K server, moderated only by deployment rarity. |
| Exploit ScenarioDerived | An attacker on the network uploads a crafted backup zip to the unauthenticated /skServer/validateBackup endpoint, overwriting the shared global restoreFilePath to point at their malicious archive. When the administrator (or the attacker, if /restore is reachable) triggers the Restore function, the server unzips attacker-controlled files over security.json and package.json, planting a rogue admin account and enabling command injection via the App Store install path for RCE. A full end-to-end Python PoC is published in the GitHub advisory (GHSA-w3x5-7c4c-66p9). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 01, 2026
Unauthenticated server state pollution in Signal K Server prior to version 2.19.0 lets a network-reachable attacker overwrite the module-global restoreFilePath via the unauthenticated /skServer/validateBackup endpoint, hijacking the administrator's Restore workflow so that attacker-supplied archive contents are written over critical configuration files such as security.json. Overwriting security.json allows creation of a rogue administrator account, which the attacker can then use to reach a separate command-injection flaw in the App Store install path and achieve remote code execution. Publicly available exploit code exists and the vendor explicitly warns Internet-exposed instances to patch immediately, though EPSS remains low at roughly 0.10% (27th percentile); no confirmed active exploitation (CISA KEV) is associated with this issue at time of analysis.
Earlier versions of this analysis (1)
Signal K boat server allows unauthenticated state pollution to hijack backup restore, enabling config overwrite and OS command injection.
RemediationAI
Upgrade Signal K Server to version 2.19.0, which is the vendor-released patch; the fix is also visible in the upstream commit https://github.com/SignalK/signalk-server/commit/5c211eaf33f0ccadbaed6720264780d92afbd7f8, and the advisory is at https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9 with release notes at https://github.com/SignalK/signalk-server/releases/tag/v2.19.0. Because the vulnerable /skServer/validateBackup endpoint requires no authentication, priority should go to any instance reachable from the Internet, which the vendor explicitly flags as high risk. If immediate upgrade is not possible, compensating controls include blocking or restricting network access to /skServer/validateBackup and /skServer/restore at the reverse proxy or firewall (trade-off: legitimate backup validation and restore operations will be unavailable until the patch is applied), and removing Internet exposure of the Signal K admin API entirely by placing it behind a trusted network or VPN (trade-off: loss of remote administration convenience). Administrators should also audit security.json for unexpected accounts and review recently restored archives for signs of tampering before patching, since a successful prior restore could have already introduced a rogue administrator account that the upgrade alone would not remove.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Signal K Server is a Node.js/TypeScript server application that acts as a central data hub on boats, exposing REST endpoints under the /skServer prefix and a plugin/App Store system backed by npm. The root defect is a classic shared-mutable-state error: the variable restoreFilePath is declared at module scope in src/serverroutes.ts, making it global to all requests instead of per-session. The /skServer/validateBackup endpoint accepts an uploaded archive, writes it to a temporary directory, and assigns that path to the global variable - but it lacks authentication middleware, so any unauthenticated network client can set it. The privileged /skServer/restore endpoint later reads that same global and extracts the archive via unzipper.Extract({ path: restoreFilePath }), so an attacker who pollutes the variable first can control what gets restored and where. Although the CVE is classified as CWE-78 (OS command injection), reflecting the ultimate RCE goal, the disclosed chain is layered: state pollution enables config-file overwrite (notably security.json, yielding account takeover), and the attacker then abuses command injection in the App Store install routine (e.g., npm install argument injection) to run system commands. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H matching the assigned 8.8 correctly captures that no credentials or privileges are needed to pollute state, but completion of the RCE depends on the admin Restore function being invoked, hence the UI:R component. CPE cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:* confirms all released versions before the 2.19.0 fix are in scope; 2.19.0 also bundles broader hardening such as helmet security headers, stricter cookie flags, constant-time login handling, and improved log-file-name validation.
Know when Signal K Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated network endpoint (PR:N/AV:N/AC:L) pollutes shared state, but RCE hinges on the admin-triggered Restore workflow (UI:R); config overwrite and code execution yield full C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (restoreFilePath) of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., security.json, package.json), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.
Executive ViewAI
Signal K Server, an open-source platform used to aggregate and distribute vessel telemetry and onboard system data, is affected by a high-severity flaw (CVE-2025-66398, CVSS 8.8) that allows a network-reachable attacker to corrupt administrator configuration, including security.json, and create a rogue administrator account that can be chained into remote code execution on the server. Any organization with an internet-facing or untrusted-network-accessible Signal K instance should treat that host as a potential entry point into the wider operational environment, and publicly available exploit code exists (no confirmed active exploitation is associated with this issue at time of analysis). Because the affected platform often sits alongside navigation, monitoring, and control systems, compromise of a single instance can cascade into downstream operational and safety risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
More in Signal K Server
View allCommand injection in Signal K Server (maritime navigation) before 1.5.0 allows authenticated users to execute OS command
Signal K Server before 2.19.0 exposes two features that chain together to steal JWT tokens without authentication: WebSo
Signal K Server releases before 2.19.0 let an unauthenticated remote attacker submit a device access request whose attac
Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore i
Signal K Server is a server application that runs on a central hub in a boat. [CVSS 5.3 MEDIUM]
Signal K Server versions prior to 2.20.3 on Windows contain a path traversal vulnerability in the applicationData API th
Exploit-DB