Signalk Server EUVD-2026-18372

No special conditions — remote unauthenticated exploitation against default Signal K Server installations prior to version 2.24.0-beta.4. Attacker exploits /enableSecurity endpoint to inject Admin role and gain full Administrator access.

This vulnerability presents extreme real-world risk despite no confirmed active exploitation. The CVSS vector shows the worst-case network attack profile: remotely exploitable (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), yielding high confidentiality and integrity impact. While EPSS data is not provided, the authentication bypass nature and public advisory disclosure significantly increase exploitation probability. The marine vessel context elevates impact beyond typical IT systems-unauthorized access enables tampering with navigation routing, spoofing sensor data, and disrupting safety-critical systems. Attack complexity is minimal (single HTTP request to /enableSecurity), making this automatable and accessible to low-skill attackers. The availability impact is rated Low (A:L) in CVSS, but integrity compromise to vessel routing constitutes a safety risk. Organizations running SignalK should treat this as emergency-priority given the trivial exploit barrier and safety implications, even absent confirmed exploitation. The beta status of the patched version (2.24.0-beta.4) may complicate immediate remediation for production systems.

An attacker scans marina networks or satellite internet-connected vessels for exposed SignalK Server instances (commonly running on ports 3000 or 80). Upon identifying a target, the attacker sends an unauthenticated HTTP POST request to the /enableSecurity endpoint with crafted parameters that inject an administrator role assignment. With admin privileges established, the attacker accesses the SignalK admin interface to modify autopilot waypoints, reroute the vessel into hazardous waters, disable safety alarms, or exfiltrate vessel location and operational data. The attack requires no specialized tools beyond standard HTTP clients and completes in seconds.