CVE-2025-68273 - CVE House
Back to Database
Status published Medium CVE-2025-68273

Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

Vulnerability Description

Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68273

Credits & Attribution

No credits recorded in the NVD database.

References

More from SignalK

View All →
CVE-2025-69203
Signal K Server Vulnerable to Access Request Spoofing
Medium 6.3
CVE-2025-68620
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
Critical 9.1
CVE-2025-68619
Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package
High 7.3
CVE-2025-68272
Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding
High 7.5
CVE-2025-66398
Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)
Critical 9.7

Affected Vendor

Affected Software

signalk-server
Vulnerable Versions:
< 2.19.0

Timeline

Official Publish: January 1st, 2026
Last Modified: January 2nd, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration