CVE-2025-66398

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/SignalK/signalk-server/releases/tag/v2.19.0	Release Notes
https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*

History

01 Oct 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) Signal K Server es una aplicación de servidor que se ejecuta en un concentrador central en un barco. Antes de la versión 2.19.0, un atacante no autenticado puede contaminar el estado interno ('restoreFilePath') del servidor a través del endpoint '/skServer/validateBackup'. Esto permite al atacante secuestrar la funcionalidad 'Restaurar' del administrador para sobrescribir archivos de configuración críticos del servidor (por ejemplo, 'security.json', 'package.json'), lo que lleva a la toma de control de la cuenta y a la Ejecución Remota de Código (RCE). La versión 2.19.0 corrige esta vulnerabilidad.

Information

Published : 2026-01-01 18:15

Updated : 2026-10-07 11:10

NVD link : CVE-2025-66398

Mitre link : CVE-2025-66398

CVE.ORG link : CVE-2025-66398

JSON object : View

Products Affected

signalk

signal_k_server

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-913

Improper Control of Dynamically-Managed Code Resources

{"id": "CVE-2025-66398", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66398", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-05T21:00:27.609924Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "SignalK", "product": "signalk-server", "versions": [{"status": "affected", "version": "< 2.19.0"}]}]}], "published": "2026-01-01T18:15:40.550", "references": [{"url": "https://github.com/SignalK/signalk-server/releases/tag/v2.19.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}, {"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's \"Restore\" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability."}, {"lang": "es", "value": "Signal K Server es una aplicaci\u00f3n de servidor que se ejecuta en un concentrador central en un barco. Antes de la versi\u00f3n 2.19.0, un atacante no autenticado puede contaminar el estado interno ('restoreFilePath') del servidor a trav\u00e9s del endpoint '/skServer/validateBackup'. Esto permite al atacante secuestrar la funcionalidad 'Restaurar' del administrador para sobrescribir archivos de configuraci\u00f3n cr\u00edticos del servidor (por ejemplo, 'security.json', 'package.json'), lo que lleva a la toma de control de la cuenta y a la Ejecuci\u00f3n Remota de C\u00f3digo (RCE). La versi\u00f3n 2.19.0 corrige esta vulnerabilidad."}], "lastModified": "2026-10-07T11:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "102A9593-CCDC-4532-8201-E67EEFC665E0", "versionEndExcluding": "2.19.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}