PT-2026-1015 · Unknown · Signal K Server

Published 2026-01-01 · Updated 2026-01-12 · CVE-2025-66398

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Signal K Server versions prior to 2.19.0

Description Signal K Server, a server application used on boats, is susceptible to an issue where an unauthenticated attacker can manipulate the server's internal state. This manipulation occurs through the /skServer/validateBackup API endpoint, specifically targeting the restoreFilePath variable. Successful exploitation allows an attacker to hijack the administrator's "Restore" functionality, enabling them to overwrite critical server configuration files such as security.json and package.json. This can lead to account takeover and Remote Code Execution (RCE).

Recommendations Versions prior to 2.19.0 should be updated to version 2.19.0 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-913

CWE-78

Related Identifiers

CVE-2025-66398

GHSA-W3X5-7C4C-66P9

Affected Products

Signal K Server

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66398.json · Exploit
• https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66398 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w3x5-7c4c-66p9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66398 · Security Note
• https://github.com/SignalK/signalk-server · Note
• https://github.com/SignalK/signalk-server/releases/tag/v2.19.0 · Note
• https://github.com/SignalK/signalk-server/commit/5c211eaf33f0ccadbaed6720264780d92afbd7f8 · Note
• https://twitter.com/cracbot/status/2008493795114119444 · Twitter Post
• https://t.me/cveNotify/147446 · Telegram Post
• https://t.me/CVEtracker/41184 · Telegram Post
• https://twitter.com/CveFindCom/status/2006797391492452737 · Twitter Post
• https://t.me/cveNotify/147890 · Telegram Post
• https://twitter.com/0dayPublishing/status/2006790220050559335 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2006806756626706557 · Twitter Post