CVE-2025-66398
CRITICAL
GHSA-w3x5-7c4c-66p9
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.
Analysis
Signal K Server (for boats) before 2.19.0 allows unauthenticated attackers to hijack the backup restore function by polluting the internal restoreFilePath state via the /validateBackup endpoint. This enables overwriting security.json and other critical files to achieve OS command injection.
Technical Context
The /skServer/validateBackup endpoint is unauthenticated and can modify the server's internal restoreFilePath state (CWE-78). An attacker sets restoreFilePath to point to a malicious backup archive, then when an admin triggers 'Restore', the server overwrites security.json (disabling authentication), package.json, or other critical files.
Affected Products
Signal K Server before 2.19.0
Remediation
Update to Signal K Server 2.19.0 or later. Restrict server access to trusted networks. Do not expose boat systems directly to the internet.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today