Signal K Server <= 2.18.0 - Information Disclosure

mediumseverity

5.3CVSS score

0.8%likelihood of exploitation, next 30 days

58%of all CVEs are less likely

Readycheck to confirm it

Signal K Server versions up to and including 2.18.0 expose the /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer endpoints without authentication. These routes were missing from the authentication middleware configuration, letting any unauthenticated user retrieve the full Signal K data schema, the list of connected serial devices, and whether traffic analyzer tools are installed. This template fingerprints the server via the public /signalk discovery endpoint and flags builds older than the fixed 2.19.0 release.

Impact

An unauthenticated attacker can enumerate the vessel data schema, connected hardware serial ports, and installed analyzer tooling, aiding reconnaissance for further attacks against the marine data server.

Fix

Upgrade to Signal K Server 2.19.0 or later, which adds the missing endpoints to the authentication middleware.

How to confirm it

Send: GET {{BaseURL}}/skServer/serialports
Positive when: contains "path\":\"" and "serialports\":[{" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2025-68273 -u <target>

The full check

id: CVE-2025-68273

info:
  name: Signal K Server <= 2.18.0 - Information Disclosure
  author: ChrisJr404
  severity: medium
  description: |
    Signal K Server versions up to and including 2.18.0 expose the /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer endpoints without authentication. These routes were missing from the authentication middleware configuration, letting any unauthenticated user retrieve the full Signal K data schema, the list of connected serial devices, and whether traffic analyzer tools are installed. This template fingerprints the server via the public /signalk discovery endpoint and flags builds older than the fixed 2.19.0 release.
  impact: |
    An unauthenticated attacker can enumerate the vessel data schema, connected hardware serial ports, and installed analyzer tooling, aiding reconnaissance for further attacks against the marine data server.
  remediation: |
    Upgrade to Signal K Server 2.19.0 or later, which adds the missing endpoints to the authentication middleware.
  reference:
    - https://github.com/SignalK/signalk-server/security/advisories/GHSA-fpf5-w967-rr2m
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68273
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-68273
    cwe-id: CWE-200
    epss-score: 0.00823
    epss-percentile: 0.57646
  metadata:
    verified: true
    max-request: 1
    vendor: signalk
    product: signalk-server
    shodan-query: title:"Signal K Server"
    fofa-query: title="Signal K Server"
  tags: cve,cve2025,signalk,exposure,iot

http:
  - method: GET
    path:
      - "{{BaseURL}}/skServer/serialports"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'path":"'
          - 'serialports":[{'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from