CVE-2026-23515
CRITICAL
GHSA-p8gp-2w28-mhwg
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4Description
Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages. This vulnerability is fixed in 1.5.0.
Analysis
Command injection in Signal K Server (maritime navigation) before 1.5.0 allows authenticated users to execute OS commands. EPSS 4.96% with PoC and patch available.
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all Signal K Server instances in your environment and determine which have the set-system-time plugin enabled; isolate affected systems from critical networks if patching cannot be completed immediately. Within 7 days: Apply vendor patch to upgrade Signal K Server to version 1.5.0 or later on all instances; verify patch installation and restart services. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today