CVE-2025-68273 Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

What is CVE-2025-68273?

CVE-2025-68273 is a medium-severity vulnerability in signalk-server, published on 1 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.

Weakness: CWE-200

Which versions are affected by CVE-2025-68273?

2 open source packages ship an affected version, including signalk-server. It affects 1 product.

Products include Signalk Signal K Server.

How do I fix CVE-2025-68273?

Upgrade signalk-server to 2.19.0 or later.

Is CVE-2025-68273 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68273 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in signalk-server

• CVE-2026-23515 RCE - Command Injection in Signal K set-system-time plugin Critical 10.0
• CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) Critical 9.7
• CVE-2026-33950 signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity Critical 9.4
• CVE-2025-68620 Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling Critical 9.1
• CVE-2026-41893 Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fpf5-w967-rr2m.