CVE-2025-68273
published 2026-01-01CVE-2025-68273: Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.34%
25.6th percentile
Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| signalk | signal_k_server | < 2.19.0 | 2.19.0 |
| signalk | signalk-server | < 2.19.0 | 2.19.0 |
| signalk | signalk-server | >= 0 < 2.19.0 | 2.19.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
ghsa·2026-01-02
CVE-2025-68273 [MEDIUM] CWE-200 Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
[Note] This is a separate issue from the RCE vulnerability (State Pollution) currently being patched. While related to tokensecurity.js, it involves different endpoints and risks.
### Summary
An unauthenticated information disclosure vulnerability allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks.
### Details
The vulnerability stems from the fact that several sensitive API endpoints are not included in the authentication middleware's protection list in `src/tokensecurity.js`.
**Vulnerable Code Analysis:**
1. **Missing Protection**: Th
OSV
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
osv·2026-01-02
CVE-2025-68273 [MEDIUM] Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
[Note] This is a separate issue from the RCE vulnerability (State Pollution) currently being patched. While related to tokensecurity.js, it involves different endpoints and risks.
### Summary
An unauthenticated information disclosure vulnerability allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks.
### Details
The vulnerability stems from the fact that several sensitive API endpoints are not included in the authentication middleware's protection list in `src/tokensecurity.js`.
**Vulnerable Code Analysis:**
1. **Missing Protection**: Th
No detection rules found.
No public exploits indexed.
2026-01-01
Published