Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.

Source published

1 Jan 2026 18:21:51 UTC

Source modified

2 Jan 2026 18:56:08 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.

Source published

Jan 1, 2026, 6:21:51 PM (timezone not stated)

Source modified

Jan 2, 2026, 6:56:08 PM (timezone not stated)

Observed here

11 Nov 2026 04:35:26 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.

Source published

1 Jan 2026 19:15:53 UTC

Source modified

7 Oct 2026 11:10:00 UTC

Observed here

25 Oct 2026 04:17:10 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS 3.1 · [email protected] · Primary · 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

[Note] This is a separate issue from the RCE vulnerability (State Pollution) currently being patched. While related to tokensecurity.js, it involves different endpoints and risks. ### Summary An unauthenticated information disclosure vulnerability allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. ### Details The vulnerability stems from the fact that several sensitive API endpoints are not included in the authentication middleware's protection list in `src/tokensecurity.js`. **Vulnerable Code Analysis:** 1. **Missing Protection**: The `tokensecurity.js` file defines an array of paths that require authentication. However, the following paths defined in `src/serverroutes.ts` are missing from this list: - `/skServer/serialports` - `/skServer/availablePaths` - `/skServer/hasAnalyzer` 2. **Unrestricted Access**: Because they are missing from the protection list, the `http_authorize` middleware allows access to these paths even when `enableSecurity` is set to `true`. **Exploit Scenario:** 1. **Reconnaissance**: An attacker scans the server for these endpoints. 2. **Data Extraction**: - Querying `/skServer/availablePaths` returns the full JSON schema of the vessel's data (e.g., `environment.sun.sunrise`, `navigation.position`), allowing the attacker to know exactly what data points are available for targeting. - Querying `/skServer/serialports` reveals connected hardware (e.g., `/dev/ttyUSB0`), aiding in physical device targeting. ### PoC The following Python script demonstrates the vulnerability by querying the exposed endpoints without any authentication headers. ```python import urllib.request import json BASE_URL = "http://localhost:3000" def check_endpoint(name, path): url = f"{BASE_URL}{path}" print(f"[*] Checking {name} at {url}...") try: req = urllib.request.Request(url) with urllib.request.urlopen(req) as response: if response.getcode() == 200: print(f"[!] VULNERABLE: {name} is accessible without authentication!") content = response.read().decode('utf-8') print(f" Snippet: {content[:100]}...") else: print(f"[-] Secure: {response.getcode()}") except urllib.error.HTTPError as e: print(f"[-] Secure: {e.code}") except Exception as e: print(f"[-] Error: {e}") if __name__ == "__main__": print("--- SignalK Information Disclosure PoC ---") check_endpoint("Serial Ports", "/skServer/serialports") check_endpoint("Available Paths", "/skServer/availablePaths") check_endpoint("Analyzer Check", "/skServer/hasAnalyzer") ``` **Expected Result:** The script will output `[!] VULNERABLE` for all three endpoints, showing snippets of the leaked JSON data. ### Impact **Verified Information Disclosure**: During our verification, we successfully retrieved the following sensitive information without any authentication: 1. **Full Data Schema**: The `/skServer/availablePaths` endpoint returned the complete JSON schema of the vessel's data. * **Example**: `environment.sun.sunrise`, `navigation.position` * **Leakage of Internal State**: We also observed entries like `notifications.security.accessRequest.readwrite.attacker-device-32`, which revealed the presence and IDs of pending access requests (traces of our DoS attack), showing that internal server state is exposed. 2. **Hardware Configuration**: The `/skServer/serialports` endpoint exposed the list of connected serial devices. 3. **System Capabilities**: The `/skServer/hasAnalyzer` endpoint revealed whether traffic analysis tools were installed. This information allows an attacker to map the system's internal state and capabilities, significantly facilitating further targeted attacks (Reconnaissance). --- ### Remediation **Update `src/tokensecurity.js`** Add the missing paths to the list of protected routes in `src/tokensecurity.js`. ```javascript // src/tokensecurity.js // ... existing protected paths ... ;[ '/apps', '/appstore', '/plugins', '/restart', '/runDiscovery', '/security', '/vessel', '/providers', '/settings', '/webapps', '/skServer/inputTest', // ADD THESE LINES: '/skServer/serialports', '/skServer/availablePaths', '/skServer/hasAnalyzer' ].forEach((p) => app.use(`${SERVERROUTESPREFIX}${p}`, http_authorize(false)) ) ```

Source published

2 Jan 2026 15:22:11 UTC

Source modified

3 Feb 2026 03:14:49 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Publisher rating · MODERATE