{"id":"CVE-2025-68273","sourceIdentifier":"security-advisories@github.com","published":"2026-01-01T19:15:53.630","lastModified":"2026-10-07T11:10:00.153","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue."},{"lang":"es","value":"Signal K Server es una aplicación de servidor que se ejecuta en un concentrador central en un barco. Una vulnerabilidad de revelación de información no autenticada en versiones anteriores a la 2.19.0 permite a cualquier usuario recuperar información sensible del sistema, incluyendo el esquema de datos completo de SignalK, dispositivos serie conectados y herramientas de análisis instaladas. Esta exposición facilita el reconocimiento para ataques posteriores. La versión 2.19.0 corrige el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"SignalK","product":"signalk-server","versions":[{"version":"< 2.19.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-02T18:55:48.224636Z","id":"CVE-2025-68273","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:signalk:signal_k_server:*:*:*:*:*:*:*:*","versionEndExcluding":"2.19.0","matchCriteriaId":"102A9593-CCDC-4532-8201-E67EEFC665E0"}]}]}],"references":[{"url":"https://github.com/SignalK/signalk-server/releases/tag/v2.19.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/SignalK/signalk-server/security/advisories/GHSA-fpf5-w967-rr2m","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}