CVE-2025-69203
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Signal K Server before version 2.19.0 has a vulnerability in the access request system that combines two related issues: improper display of the `permissions` field (less visible than the description) and unconditional trust in the `X-Forwarded-For` header for determining the client's IP address. An attacker can exploit these flaws to craft a convincing social engineering attack against an administrator, impersonating a trusted device and requesting elevated permissions.
Risk Assessment
The risk is that an administrator may approve an access request with full permissions, believing it is read-only and from a trusted IP address, leading to unauthorized access and potential system compromise.
Recommendation
It is recommended to immediately upgrade Signal K Server to version 2.19.0 or later, which fixes this vulnerability. Additionally, before upgrading, exercise caution when approving access requests and verify permissions and IP address independently of displayed information.
Other vulnerabilities in Signal K Server
See all- CVE-2026-33950Critical
Signal K Server before version 2.24.0-beta.4 has a privilege escalation vulnerability via admin role injection in the /enableSecurity endpoint. An unauthenticated attacker can gain full administrative access.
- CVE-2025-68620Critical
Signal K Server before version 2.19.0 contains two vulnerabilities that can be chained to steal JWT tokens without any authentication. The first is unauthenticated WebSocket request enumeration via the serverevents=all parameter, and the second is unauthenticated polling of access request status, which returns the JWT token in plaintext after an administrator approves the request.
- CVE-2025-66398Critical
Signal K Server before version 2.19.0 allows an unauthenticated attacker to pollute the internal state (restoreFilePath) via the /skServer/validateBackup endpoint, enabling hijacking of the administrator's Restore functionality to overwrite critical configuration files, leading to account takeover and RCE.
- CVE-2026-55591Medium
Signal K Server prior to 2.28.0 has a vulnerability in makeRemoteRequest() that accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters without validating the destination. When security is not configured, the endpoints testSignalKConnection, requestAccess, and checkAccessRequest are accessible without authentication, allowing port scanning, exfiltration of cloud metadata and internal service data, and lateral movement.
- CVE-2026-41893High
Signal K Server prior to version 2.25.0 protects HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) with express-rate-limit (default: 100 attempts per 10-minute window). However, the WebSocket login path — sending {login: {username, password}} messages over an established WebSocket connection — calls app.securityStrategy.login() directly without any rate limiting. An attacker can bypass HTTP rate limiting entirely by opening a WebSocket connection and attempting unlimited password guesses at the speed bcrypt allows (~20 attempts/sec with 10 salt rounds). This issue has been fixed in version 2.25.0.
- CVE-2026-35038Medium
Signal K Server before version 2.24.0 has a prototype read vulnerability via `from` field bypass. A low-privileged authenticated user can bypass prototype boundary filtering to read internal functions and properties from the global prototype object.
- CVE-2026-34083Medium
Signal K Server before version 2.24.0 has a vulnerability in OIDC login/logout handlers where the unvalidated Host header is used to construct the OAuth2 redirect_uri. Since redirectUri is unset by default, an attacker can spoof the Host header to steal OAuth authorization codes and hijack user sessions.
- CVE-2026-33951High
Signal K Server before version 2.24.0-beta.1 exposes an unauthenticated HTTP endpoint PUT /signalk/v1/api/sourcePriorities that allows remote attackers to modify navigation data source priorities. Changes are applied immediately and persisted.
- CVE-2025-68619High
Signal K Server prior to version 2.19.0 in the appstore interface allows administrators to install npm packages through a REST API endpoint. While the package name is validated, the version parameter accepts arbitrary npm version specifiers including URLs, enabling installation from attacker-controlled sources and execution of malicious postinstall scripts. Version 2.19.0 contains a patch.
- CVE-2025-68273Medium
Signal K Server prior to version 2.19.0 has an unauthenticated information disclosure vulnerability allowing any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. Version 2.19.0 patches the issue.
Original NVD description (English source)
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability enable convincing social engineering attacks against administrators. When a device creates an access request, it specifies three fields: `clientId`, `description`, and `permissions`. The SignalK admin UI displays the `description` field prominently to the administrator when showing pending requests, but the actual `permissions` field (which determines the access level granted) is less visible or displayed separately. This allows an attacker to request `admin` permissions while providing a description that suggests readonly access. The access request handler trusts the `X-Forwarded-For` HTTP header without validation to determine the client's IP address. This header is intended to preserve the original client IP when requests pass through reverse proxies, but when trusted unconditionally, it allows attackers to spoof their IP address. The spoofed IP is displayed to administrators in the access request approval interface, potentially making malicious requests appear to originate from trusted internal network addresses. Since device/source names can be enumerated via the information disclosure vulnerability, an attacker can impersonate a legitimate device or source, craft a convincing description, spoof a trusted internal IP address, and request elevated permissions, creating a highly convincing social engineering scenario that increases the likelihood of administrator approval. Users should upgrade to version 2.19.0 to fix this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS