Signal K Server <= 2.18.0 - Information Disclosure
CVE-2025-68273
Early Release
Description
Signal K Server versions up to and including 2.18.0 expose the /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer endpoints without authentication. These routes were missing from the authentication middleware configuration, letting any unauthenticated user retrieve the full Signal K data schema, the list of connected serial devices, and whether traffic analyzer tools are installed. This template fingerprints the server via the public /signalk discovery endpoint and flags builds older than the fixed 2.19.0 release.
Severity
Medium
CVSS Score
5.3
Exploit Probability
0%
Affected Product
signalk-server
Published Date
August 24, 2026
Template Author
chrisjr404
CVE-2025-68273.yaml
5.3Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2025-68273
CWE ID:
cwe-200
Remediation Steps
Upgrade to Signal K Server 2.19.0 or later, which adds the missing endpoints to the authentication middleware.