CVE-2025-66398 - CVE House
Back to Database
Status published Critical CVE-2025-66398

Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Vulnerability Description

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66398

Credits & Attribution

No credits recorded in the NVD database.

References

More from SignalK

View All →
CVE-2025-69203
Signal K Server Vulnerable to Access Request Spoofing
Medium 6.3
CVE-2025-68620
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
Critical 9.1
CVE-2025-68619
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
High 7.3
CVE-2025-68273
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
Medium 5.3
CVE-2025-68272
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding
High 7.5

Affected Vendor

Affected Software

signalk-server
Vulnerable Versions:
< 2.19.0

Timeline

Official Publish: January 1st, 2026
Last Modified: January 5th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78 CWE-913

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration