Signal K Server <= 2.18.0 - Information Disclosure

id: CVE-2025-68273

info:
  name: Signal K Server <= 2.18.0 - Information Disclosure
  author: ChrisJr404
  severity: medium
  description: |
    Signal K Server versions up to and including 2.18.0 expose the /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer endpoints without authentication. These routes were missing from the authentication middleware configuration, letting any unauthenticated user retrieve the full Signal K data schema, the list of connected serial devices, and whether traffic analyzer tools are installed. This template fingerprints the server via the public /signalk discovery endpoint and flags builds older than the fixed 2.19.0 release.
  impact: |
    An unauthenticated attacker can enumerate the vessel data schema, connected hardware serial ports, and installed analyzer tooling, aiding reconnaissance for further attacks against the marine data server.
  remediation: |
    Upgrade to Signal K Server 2.19.0 or later, which adds the missing endpoints to the authentication middleware.
  reference:
    - https://github.com/SignalK/signalk-server/security/advisories/GHSA-fpf5-w967-rr2m
    - https://nvd.nist.gov/vuln/detail/CVE-2025-68273
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-68273
    cwe-id: CWE-200
    epss-score: 0.00359
    epss-percentile: 0.28563
  metadata:
    verified: true
    max-request: 1
    vendor: signalk
    product: signalk-server
    shodan-query: title:"Signal K Server"
    fofa-query: title="Signal K Server"
  tags: cve,cve2025,signalk,exposure,iot

http:
  - method: GET
    path:
      - "{{BaseURL}}/skServer/serialports"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'path":"'
          - 'serialports":[{'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022065b3f8970f3de906054c9695229148115f698bab34094bf566bdf40067528a3e022100d651c5701400da065df55aa9ce47d73c3f3075298ed232425e2aed62b91e8c74:922c64590222798bb761d5b6d8e72950