Signal K Server
Monthly
Command injection in Signal K Server (maritime navigation) before 1.5.0 allows authenticated users to execute OS commands. EPSS 4.96% with PoC and patch available.
Signal K Server versions prior to 2.20.3 on Windows contain a path traversal vulnerability in the applicationData API that allows authenticated users to read, write, and list arbitrary files by bypassing directory validation using backslashes. The vulnerability exists because the validateAppId() function only blocks forward slashes, allowing attackers to escape the intended applicationData directory through Windows path semantics. Public exploit code exists for this medium-severity flaw, and a patch is available in version 2.20.3.
Signal K Server releases before 2.19.0 let an unauthenticated remote attacker submit a device access request whose attacker-controlled `description` field reads like a benign read-only request while the `permissions` field actually asks for `admin`; the pre-2.19.0 admin UI displays the description prominently and the authoritative permission level less visibly. The same access-request handler trusts the client-supplied `X-Forwarded-For` header without validation, so the source IP shown to the approving administrator can be spoofed to look like a trusted internal address, and chaining this with the accompanying device/source-name information disclosure produces a convincing social-engineering scenario. Publicly available exploit code exists, but the attack is not confirmed actively exploited (CISA KEV is absent) and EPSS is only 0.02% (6th percentile) because a human administrator must manually approve the request (UI:R); Internet-reachable Signal K servers are the highest-risk deployments and the vendor explicitly urges immediate upgrade.
Signal K Server before 2.19.0 exposes two features that chain together to steal JWT tokens without authentication: WebSocket-based request enumeration plus unauthenticated polling of access request status. An attacker can hijack admin sessions remotely. PoC available.
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. [CVSS 7.2 HIGH]
Signal K Server is a server application that runs on a central hub in a boat. [CVSS 5.3 MEDIUM]
Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). [CVSS 7.5 HIGH]
Unauthenticated server state pollution in Signal K Server prior to version 2.19.0 lets a network-reachable attacker overwrite the module-global restoreFilePath via the unauthenticated /skServer/validateBackup endpoint, hijacking the administrator's Restore workflow so that attacker-supplied archive contents are written over critical configuration files such as security.json. Overwriting security.json allows creation of a rogue administrator account, which the attacker can then use to reach a separate command-injection flaw in the App Store install path and achieve remote code execution. Publicly available exploit code exists and the vendor explicitly warns Internet-exposed instances to patch immediately, though EPSS remains low at roughly 0.10% (27th percentile); no confirmed active exploitation (CISA KEV) is associated with this issue at time of analysis.
Command injection in Signal K Server (maritime navigation) before 1.5.0 allows authenticated users to execute OS commands. EPSS 4.96% with PoC and patch available.
Signal K Server versions prior to 2.20.3 on Windows contain a path traversal vulnerability in the applicationData API that allows authenticated users to read, write, and list arbitrary files by bypassing directory validation using backslashes. The vulnerability exists because the validateAppId() function only blocks forward slashes, allowing attackers to escape the intended applicationData directory through Windows path semantics. Public exploit code exists for this medium-severity flaw, and a patch is available in version 2.20.3.
Signal K Server releases before 2.19.0 let an unauthenticated remote attacker submit a device access request whose attacker-controlled `description` field reads like a benign read-only request while the `permissions` field actually asks for `admin`; the pre-2.19.0 admin UI displays the description prominently and the authoritative permission level less visibly. The same access-request handler trusts the client-supplied `X-Forwarded-For` header without validation, so the source IP shown to the approving administrator can be spoofed to look like a trusted internal address, and chaining this with the accompanying device/source-name information disclosure produces a convincing social-engineering scenario. Publicly available exploit code exists, but the attack is not confirmed actively exploited (CISA KEV is absent) and EPSS is only 0.02% (6th percentile) because a human administrator must manually approve the request (UI:R); Internet-reachable Signal K servers are the highest-risk deployments and the vendor explicitly urges immediate upgrade.
Signal K Server before 2.19.0 exposes two features that chain together to steal JWT tokens without authentication: WebSocket-based request enumeration plus unauthenticated polling of access request status. An attacker can hijack admin sessions remotely. PoC available.
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. [CVSS 7.2 HIGH]
Signal K Server is a server application that runs on a central hub in a boat. [CVSS 5.3 MEDIUM]
Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). [CVSS 7.5 HIGH]
Unauthenticated server state pollution in Signal K Server prior to version 2.19.0 lets a network-reachable attacker overwrite the module-global restoreFilePath via the unauthenticated /skServer/validateBackup endpoint, hijacking the administrator's Restore workflow so that attacker-supplied archive contents are written over critical configuration files such as security.json. Overwriting security.json allows creation of a rogue administrator account, which the attacker can then use to reach a separate command-injection flaw in the App Store install path and achieve remote code execution. Publicly available exploit code exists and the vendor explicitly warns Internet-exposed instances to patch immediately, though EPSS remains low at roughly 0.10% (27th percentile); no confirmed active exploitation (CISA KEV) is associated with this issue at time of analysis.