Signal K Server CVE-2025-69203

Requires a reachable Signal K access-request endpoint and that device/source onboarding via access requests is in use. Two product-specific conditions enable the attack: the admin access-request approval UI displays the attacker-supplied description prominently while rendering the authoritative permissions field less visibly (pre-2.19.0 behavior, fixed by PR #2179), and the server trusts the X-Forwarded-For header unconditionally for client IP (fixed by the opt-in trusted-proxy support in PR #2204). The decisive LIMITING factor is UI:R - a human administrator must manually approve the malicious request, so success depends on deceiving that operator rather than on an automatable code path (consistent with EPSS 0.02%). Exposure is materially higher for servers reachable from the Internet, which the vendor explicitly flags as needing urgent update.

Signals conflict sharply: the vendor CVSS 3.1 base score is 8.8 (High) with full C:H/I:H/A:H, yet EPSS is near the floor at 0.02% (6th percentile) and there is no CISA KEV listing - indicating essentially no observed or predicted mass-exploitation. The high score derives entirely from the consequence of success (an attacker ending up with admin on the server), but exploitation is gated by UI:R: a human administrator must be socially engineered into approving a malicious access request. CWE-290 (Authentication Bypass by Spoofing) is accurate - the core defects are a UI that de-emphasizes the requested permissions relative to the attacker-controlled description, and unconditional trust of the X-Forwarded-For header allowing source-IP spoofing. A GitHub Security Advisory (GHSA-vfrf-vcj7-wvr8) documents the technique publicly, so exploit/PoC information exists, but this is a social-engineering chain, not a point-and-click weaponized exploit; PoC availability should not be conflated with active exploitation. Net: this is a legitimately serious design flaw for exposed Signal K servers, but real-world priority is moderated by the niche deployment footprint, the mandatory admin-approval step, and the near-zero EPSS. Treat as a 'patch promptly if internet-exposed' item (the vendor itself flags the release as urgent for internet-accessible servers) rather than an emergency for isolated on-boat installs.

An attacker who can reach the Signal K server's access-request endpoint enumerates legitimate device/source names via the companion information-disclosure flaw, then submits an access request that asks for admin permissions while writing a description implying harmless read-only sensor access, and sets a spoofed X-Forwarded-For header so the request appears to come from a trusted internal LAN address. The administrator, seeing a plausible description from a familiar device name at a trusted IP, approves it and unknowingly grants the attacker full admin control. The technique is publicly documented in the vendor's GitHub Security Advisory.