What’s Vulnerable › Vulnerabilities

CVE-2025-68273: Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-01 · updated 2026-10-07
• Weakness: CWE-200

Description

Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.

Affected products

• signalk-server: before 2.19.0 — fixed in 2.19.0

How to fix

Upgrade to a fixed version: signalk-server 2.19.0. Check the vendor advisory for mitigations.

References

• https://github.com/SignalK/signalk-server/releases/tag/v2.19.0
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-fpf5-w967-rr2m

Get alerted when CVE-2025-68273 or the next vulnerability affects your stack