CVE-2025-68273: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68273 is an unauthenticated information disclosure vulnerability in Signal K Server, a marine data hub application. It affects all versions prior to 2.19.0 and allows any unauthenticated network user to retrieve sensitive system information including the full SignalK data schema, connected serial devices, and installed analyzer tools. The vulnerability was published on January 1, 2026, and patched in version 2.19.0 released the same day. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory).

The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), stemming from missing entries in the authentication middleware's protection list in src/tokensecurity.js. Three API endpoints defined in src/serverroutes.ts — /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer — were omitted from the array of paths requiring authentication, causing the http_authorize middleware to allow unauthenticated access even when enableSecurity is set to true. Exploitation requires no privileges, no user interaction, and only network access to the server's HTTP port (default 3000), making it trivially exploitable by any attacker who can reach the server (Github Advisory).

Successful exploitation allows an unauthenticated attacker to enumerate the vessel's complete data schema (e.g., navigation.position, environment.sun.sunrise), identify connected serial hardware (e.g., /dev/ttyUSB0), and determine whether traffic analysis tools are installed. Additionally, internal server state such as pending security access request IDs is exposed, which could reveal traces of prior attack activity. While there is no direct integrity or availability impact, the disclosed information significantly lowers the barrier for follow-on targeted attacks against vessel systems and connected hardware (Github Advisory, GitHub Release).

A public proof-of-concept Python script is included in the official security advisory, demonstrating unauthenticated access to all three vulnerable endpoints with no special tooling required. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.015% (3rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Signal K Server instances (default port 3000) using tools like Shodan, Censys, or nmap, targeting versions prior to 2.19.0.
2. Probe vulnerable endpoints: Send unauthenticated HTTP GET requests to the three exposed endpoints:
   • GET http://<target>:3000/skServer/availablePaths
   • GET http://<target>:3000/skServer/serialports
   • GET http://<target>:3000/skServer/hasAnalyzer
3. Extract data schema: Parse the JSON response from /skServer/availablePaths to obtain the full vessel data schema, identifying available navigation, environment, and sensor data points for targeting.
4. Enumerate hardware: Review the /skServer/serialports response to identify connected serial devices (e.g., /dev/ttyUSB0) and map physical hardware components.
5. Assess capabilities: Query /skServer/hasAnalyzer to determine if traffic analysis tools are installed, informing further attack planning.
6. Plan targeted follow-on attacks: Use the gathered intelligence to craft more sophisticated attacks against specific vessel systems, data points, or connected hardware (Github Advisory).

• Network: Unauthenticated HTTP GET requests to /skServer/serialports, /skServer/availablePaths, or /skServer/hasAnalyzer from external or unexpected IP addresses; repeated probing of these endpoints in short succession.
• Logs: Signal K Server access logs showing HTTP 200 responses to the above paths without any Authorization header or session token; multiple requests from the same source IP across all three endpoints within a short timeframe.
• Process/Application: Unusual spikes in API query volume to /skServer/ prefixed routes without corresponding authenticated sessions (Github Advisory).

Upgrade Signal K Server to version 2.19.0 or later, which adds the three vulnerable paths (/skServer/serialports, /skServer/availablePaths, /skServer/hasAnalyzer) to the authentication middleware's protection list in src/tokensecurity.js. If immediate upgrade is not possible, restrict network access to the Signal K Server port (default 3000) using firewall rules to limit exposure to trusted networks only. The release notes emphasize that servers accessible from the internet should be updated immediately (GitHub Release, Github Advisory).

The advisory was published by Signal K maintainer tkurki on January 1, 2026, and explicitly notes this is a separate issue from a concurrent RCE (State Pollution) vulnerability also being patched in the same release. The release notes for v2.19.0 flag the update as containing "important security fixes" and urge immediate updates for internet-facing servers. The vulnerability was credited to researcher NoNoNGU (Github Advisory, GitHub Release).