Signalk
Monthly
Unauthenticated remote attackers can pull a ZIP of the Signal K Server log/config directory from the /skServer/ziplogs route in every signalk-server release before 2.33.0, and that archive contains security.json with the server's HS256 JWT signing key. Possession of the secretKey lets an attacker forge administrator tokens or create a persistent admin account and then authenticate through the normal login flow, yielding full control over NMEA routing, plugin configuration and alarms on affected installations, including vessel deployments. The endpoint was confirmed reachable without credentials on a live signalk-server 2.32.0 instance and roughly 66 potentially affected servers were visible to Shodan at disclosure; no public exploit identified at time of analysis, and the vendor addressed the issue in 2.33.0 by placing the route behind admin middleware.
Signal K Server versions before 2.25.0 allow remote unauthenticated attackers to crash the server via Regular Expression Denial of Service (ReDoS) in WebSocket subscription handling. By injecting unescaped regex metacharacters into the context parameter, attackers trigger catastrophic backtracking that consumes 100% CPU and renders the server completely unresponsive to all API and socket requests. This creates a complete denial of service for marine navigation systems relying on Signal K Server as their central data hub. While EPSS score is low (0.04%, 13th percentile), the trivial exploitation complexity (AV:N/AC:L/PR:N/UI:N) and complete availability impact make this a priority for boat operators running vulnerable versions. No public exploit identified at time of analysis, but the GitHub security advisory provides clear technical details. Vendor-released patch available in version 2.25.0.
Unauthenticated privilege escalation in SignalK Server (versions prior to 2.24.0-beta.4) allows remote attackers to inject administrator roles via the /enableSecurity endpoint, granting full administrative control without credentials. Attackers can modify vessel routing data, alter server configurations, and access all restricted endpoints. No public exploit identified at time of analysis, but the critical CVSS 9.4 score reflects the trivial exploit complexity (AV:N/AC:L/PR:N) and high confidentiality/integrity impact to marine vessel control systems.
Command injection in Signal K Server (maritime navigation) before 1.5.0 allows authenticated users to execute OS commands. EPSS 4.96% with PoC and patch available.
SSRF in Signal K Server's App Store icon fetcher allows anyone who can publish an npm package carrying Signal K keywords to make every server that browses the App Store issue HTTP requests to loopback addresses, hosts on the vessel network, and cloud metadata endpoints. Affected builds are 2.28.0-beta.2 through 2.33.0; because only responses with an image/* content type are stored and returned to the admin UI, retrievable data is limited to content that can pass as an image. The issue is vendor-confirmed and fixed in 2.34.0 (CVSS 4.0 score 2.3; independent CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), carries a monitor decision label, is not in CISA KEV, and while the advisory includes a reproduction, no verified working exploit code is confirmed.
Signal K Server prior to version 2.24.0 permits low-privileged authenticated users to bypass prototype boundary filtering via a malformed `from` field, enabling arbitrary read access to internal functions and properties in the global prototype object. This confidentiality breach violates data isolation within the Signal K application and allows attackers to extract sensitive internal state they should not access. The vulnerability requires prior authentication and has been patched in version 2.24.0.
SignalK Server versions prior to 2.24.0 allow unauthenticated attackers to hijack OAuth2 sessions and steal authorization codes by spoofing the HTTP Host header in OIDC login and logout handlers. The vulnerability exploits the default-unset redirectUri configuration, causing the OIDC provider to send authorization codes to an attacker-controlled domain. EPSS score of 6.1 reflects moderate real-world risk despite the requirement for user interaction (UI:R) to initiate login.
SignalK Server prior to version 2.24.0-beta.1 allows unauthenticated remote attackers to modify navigation data source priorities through an unprotected PUT endpoint (/signalk/v1/api/sourcePriorities), enabling manipulation of which GPS, AIS, and sensor data sources are trusted by the maritime navigation system. The malicious configuration changes are immediately applied and persisted to disk, surviving server restarts and potentially causing the vessel to rely on attacker-controlled or spoofed navigation data. No public exploit code or active exploitation has been confirmed at this time.
Signal K Server versions prior to 2.20.3 on Windows contain a path traversal vulnerability in the applicationData API that allows authenticated users to read, write, and list arbitrary files by bypassing directory validation using backslashes. The vulnerability exists because the validateAppId() function only blocks forward slashes, allowing attackers to escape the intended applicationData directory through Windows path semantics. Public exploit code exists for this medium-severity flaw, and a patch is available in version 2.20.3.
Signal K Server releases before 2.19.0 let an unauthenticated remote attacker submit a device access request whose attacker-controlled `description` field reads like a benign read-only request while the `permissions` field actually asks for `admin`; the pre-2.19.0 admin UI displays the description prominently and the authoritative permission level less visibly. The same access-request handler trusts the client-supplied `X-Forwarded-For` header without validation, so the source IP shown to the approving administrator can be spoofed to look like a trusted internal address, and chaining this with the accompanying device/source-name information disclosure produces a convincing social-engineering scenario. Publicly available exploit code exists, but the attack is not confirmed actively exploited (CISA KEV is absent) and EPSS is only 0.02% (6th percentile) because a human administrator must manually approve the request (UI:R); Internet-reachable Signal K servers are the highest-risk deployments and the vendor explicitly urges immediate upgrade.
Signal K Server before 2.19.0 exposes two features that chain together to steal JWT tokens without authentication: WebSocket-based request enumeration plus unauthenticated polling of access request status. An attacker can hijack admin sessions remotely. PoC available.
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. [CVSS 7.2 HIGH]
Signal K Server is a server application that runs on a central hub in a boat. [CVSS 5.3 MEDIUM]
Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). [CVSS 7.5 HIGH]
Unauthenticated server state pollution in Signal K Server prior to version 2.19.0 lets a network-reachable attacker overwrite the module-global restoreFilePath via the unauthenticated /skServer/validateBackup endpoint, hijacking the administrator's Restore workflow so that attacker-supplied archive contents are written over critical configuration files such as security.json. Overwriting security.json allows creation of a rogue administrator account, which the attacker can then use to reach a separate command-injection flaw in the App Store install path and achieve remote code execution. Publicly available exploit code exists and the vendor explicitly warns Internet-exposed instances to patch immediately, though EPSS remains low at roughly 0.10% (27th percentile); no confirmed active exploitation (CISA KEV) is associated with this issue at time of analysis.
Unauthenticated remote attackers can pull a ZIP of the Signal K Server log/config directory from the /skServer/ziplogs route in every signalk-server release before 2.33.0, and that archive contains security.json with the server's HS256 JWT signing key. Possession of the secretKey lets an attacker forge administrator tokens or create a persistent admin account and then authenticate through the normal login flow, yielding full control over NMEA routing, plugin configuration and alarms on affected installations, including vessel deployments. The endpoint was confirmed reachable without credentials on a live signalk-server 2.32.0 instance and roughly 66 potentially affected servers were visible to Shodan at disclosure; no public exploit identified at time of analysis, and the vendor addressed the issue in 2.33.0 by placing the route behind admin middleware.
Signal K Server versions before 2.25.0 allow remote unauthenticated attackers to crash the server via Regular Expression Denial of Service (ReDoS) in WebSocket subscription handling. By injecting unescaped regex metacharacters into the context parameter, attackers trigger catastrophic backtracking that consumes 100% CPU and renders the server completely unresponsive to all API and socket requests. This creates a complete denial of service for marine navigation systems relying on Signal K Server as their central data hub. While EPSS score is low (0.04%, 13th percentile), the trivial exploitation complexity (AV:N/AC:L/PR:N/UI:N) and complete availability impact make this a priority for boat operators running vulnerable versions. No public exploit identified at time of analysis, but the GitHub security advisory provides clear technical details. Vendor-released patch available in version 2.25.0.
Unauthenticated privilege escalation in SignalK Server (versions prior to 2.24.0-beta.4) allows remote attackers to inject administrator roles via the /enableSecurity endpoint, granting full administrative control without credentials. Attackers can modify vessel routing data, alter server configurations, and access all restricted endpoints. No public exploit identified at time of analysis, but the critical CVSS 9.4 score reflects the trivial exploit complexity (AV:N/AC:L/PR:N) and high confidentiality/integrity impact to marine vessel control systems.
Command injection in Signal K Server (maritime navigation) before 1.5.0 allows authenticated users to execute OS commands. EPSS 4.96% with PoC and patch available.
SSRF in Signal K Server's App Store icon fetcher allows anyone who can publish an npm package carrying Signal K keywords to make every server that browses the App Store issue HTTP requests to loopback addresses, hosts on the vessel network, and cloud metadata endpoints. Affected builds are 2.28.0-beta.2 through 2.33.0; because only responses with an image/* content type are stored and returned to the admin UI, retrievable data is limited to content that can pass as an image. The issue is vendor-confirmed and fixed in 2.34.0 (CVSS 4.0 score 2.3; independent CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), carries a monitor decision label, is not in CISA KEV, and while the advisory includes a reproduction, no verified working exploit code is confirmed.
Signal K Server prior to version 2.24.0 permits low-privileged authenticated users to bypass prototype boundary filtering via a malformed `from` field, enabling arbitrary read access to internal functions and properties in the global prototype object. This confidentiality breach violates data isolation within the Signal K application and allows attackers to extract sensitive internal state they should not access. The vulnerability requires prior authentication and has been patched in version 2.24.0.
SignalK Server versions prior to 2.24.0 allow unauthenticated attackers to hijack OAuth2 sessions and steal authorization codes by spoofing the HTTP Host header in OIDC login and logout handlers. The vulnerability exploits the default-unset redirectUri configuration, causing the OIDC provider to send authorization codes to an attacker-controlled domain. EPSS score of 6.1 reflects moderate real-world risk despite the requirement for user interaction (UI:R) to initiate login.
SignalK Server prior to version 2.24.0-beta.1 allows unauthenticated remote attackers to modify navigation data source priorities through an unprotected PUT endpoint (/signalk/v1/api/sourcePriorities), enabling manipulation of which GPS, AIS, and sensor data sources are trusted by the maritime navigation system. The malicious configuration changes are immediately applied and persisted to disk, surviving server restarts and potentially causing the vessel to rely on attacker-controlled or spoofed navigation data. No public exploit code or active exploitation has been confirmed at this time.
Signal K Server versions prior to 2.20.3 on Windows contain a path traversal vulnerability in the applicationData API that allows authenticated users to read, write, and list arbitrary files by bypassing directory validation using backslashes. The vulnerability exists because the validateAppId() function only blocks forward slashes, allowing attackers to escape the intended applicationData directory through Windows path semantics. Public exploit code exists for this medium-severity flaw, and a patch is available in version 2.20.3.
Signal K Server releases before 2.19.0 let an unauthenticated remote attacker submit a device access request whose attacker-controlled `description` field reads like a benign read-only request while the `permissions` field actually asks for `admin`; the pre-2.19.0 admin UI displays the description prominently and the authoritative permission level less visibly. The same access-request handler trusts the client-supplied `X-Forwarded-For` header without validation, so the source IP shown to the approving administrator can be spoofed to look like a trusted internal address, and chaining this with the accompanying device/source-name information disclosure produces a convincing social-engineering scenario. Publicly available exploit code exists, but the attack is not confirmed actively exploited (CISA KEV is absent) and EPSS is only 0.02% (6th percentile) because a human administrator must manually approve the request (UI:R); Internet-reachable Signal K servers are the highest-risk deployments and the vendor explicitly urges immediate upgrade.
Signal K Server before 2.19.0 exposes two features that chain together to steal JWT tokens without authentication: WebSocket-based request enumeration plus unauthenticated polling of access request status. An attacker can hijack admin sessions remotely. PoC available.
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the appstore interface allow administrators to install npm packages through a REST API endpoint. [CVSS 7.2 HIGH]
Signal K Server is a server application that runs on a central hub in a boat. [CVSS 5.3 MEDIUM]
Signal K Server is a server application that runs on a central hub in a boat. A Denial of Service (DoS) vulnerability in versions prior to 2.19.0 allows an unauthenticated attacker to crash the SignalK Server by flooding the access request endpoint (`/signalk/v1/access/requests`). [CVSS 7.5 HIGH]
Unauthenticated server state pollution in Signal K Server prior to version 2.19.0 lets a network-reachable attacker overwrite the module-global restoreFilePath via the unauthenticated /skServer/validateBackup endpoint, hijacking the administrator's Restore workflow so that attacker-supplied archive contents are written over critical configuration files such as security.json. Overwriting security.json allows creation of a rogue administrator account, which the attacker can then use to reach a separate command-injection flaw in the App Store install path and achieve remote code execution. Publicly available exploit code exists and the vendor explicitly warns Internet-exposed instances to patch immediately, though EPSS remains low at roughly 0.10% (27th percentile); no confirmed active exploitation (CISA KEV) is associated with this issue at time of analysis.