Medium severity · published Jan 1, 2026
CVE-2025-68273
Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
signalk-server · SignalK
< 2.19.0 · source: vendor
SK
Signal K Server · Signalk
before 2.19.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-68273
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-68273
Release Notes
https://github.com/SignalK/signalk-server/releases/tag/v2.19.0
Exploit
https://github.com/SignalK/signalk-server/security/advisories/GHSA-fpf5-w967-rr2m
More from signalk-server
9.8
CVE-2026-118690
Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
9.4
CVE-2026-33950
signalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity
9.1
CVE-2025-68620
Signal K Server vulnerable to JWT Token Theft via WebSocket Enumeration and Unauthenticated Polling
8.8
CVE-2026-23515
RCE - Command Injection in Signal K set-system-time plugin
8.8
CVE-2025-69203
Signal K Server Vulnerable to Access Request Spoofing