{"id":"EUVD-2025-206140","revision":"837a40b63f7e415fa70a0988aafbacbe","records":[{"revision":"837a40b63f7e415fa70a0988aafbacbe","observedAt":"2026-11-11T06:26:43.154+00:00","statement":{"source":"euvd","id":"EUVD-2025-206140","aliases":["CVE-2025-66398","GHSA-w3x5-7c4c-66p9"],"title":"Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint.…","description":"Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's \"Restore\" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.7,"severity":null}],"references":["https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9","https://github.com/SignalK/signalk-server/releases/tag/v2.19.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206140","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jan 1, 2026, 6:00:38 PM","dateUpdated":"Jan 5, 2026, 9:00:41 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-206140","identifiers":["EUVD-2025-206140","CVE-2025-66398","GHSA-w3x5-7c4c-66p9"]},"retained":false,"historicalAffected":[]}],"coverage":[]}