cve-2025-66398

⚠️ cve-2025-66398 - Herramienta simple de prueba de concepto de RCE ⚙️ Acerca de esta herramienta Este proyecto demuestra una vulnerabilidad de ejecución remota de código RCE en Signal K Server versiones 2.18.0 y anteriores. La prueba de concepto PoC muestra cómo un atacante podría ejecutar...

cve-2025-66398

CVE-2025-66398 — PoC de RCE en Signal K Server 📜 Descripción CVE-2025-66398 es un problema del Servidor Signal K donde un atacante no autenticado puede envenenar el estado de restauración del servidor a través de /skServer/validateBackup, luego secuestrar la configuración mediante /skServer/resto...

CVE-2026-55591

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

CVE-2026-55591 Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

CVE-2026-55591 Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

EUVD-2026-78677

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

CVE-2026-55591 Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

CVE-2026-55591

Signal K Server (signalk-server, a boat central-hub server application) versions up to 2.27.0 contain a Server-Side Request Forgery (SSRF) in makeRemoteRequest() within src/serverroutes.ts. The function accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters via the testSign...

CVE-2026-55591: Server-Side Request Forgery (SSRF)

Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest in src/serverroutes.ts accepted attacker-controlled host, port, useTLS, and selfsignedcert parameters from the testSignalKConnection, requestAccess, and checkAccessRequest endpoints...

Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Summary signalk-server versions up to and including 2.27.0 contain a Server-Side Request Forgery SSRF vulnerability in three administrative endpoints used for remote Signal K server connection management. The makeRemoteRequest function accepts attacker-controlled host, port, useTLS, and...

NPM: Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

NPM: Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints vulnerability discovered by ? in WordPress Npm signalk-server versions = 2.27.0...

GHSA-Q59X-JC9F-GFQF Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints

Summary signalk-server versions up to and including 2.27.0 contain a Server-Side Request Forgery SSRF vulnerability in three administrative endpoints used for remote Signal K server connection management. The makeRemoteRequest function accepts attacker-controlled host, port, useTLS, and...

CVE-2026-41893

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

CVE-2026-41893 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...

Signal K Server 安全漏洞

The Signal K Server is an open-source marine central server developed by Signal K. Versions of the Signal K Server prior to 2.25.0 contained a security vulnerability. This vulnerability stemmed from the lack of rate limiting on the WebSocket login path, allowing attackers to bypass the HTTP rate...

CVE-2026-41893: Improper Restriction of Excessive Authentication Attempts

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints POST /login and POST /signalk/v1/auth/login are protected by express-rate-limit default: 100 attempts per 10-minute window, configurable via HTTPRATELIMITS. The WebSocke...