The vulnerability arises from unsafe construction of shell commands when the set-system-time plugin processes navigation.datetime values received via WebSocket delta messages. An attacker who can write to the server or who can bypass the security mechanisms can send specially crafted data that is interpreted as shell commands, allowing execution of arbitrary code on the host running Signal K Server. This is a classic command‑injection flaw (CWE‑78) that grants full remote code execution and could compromise the entire boat’s network, data, and control systems.

Signal K Server versions earlier than 1.5.0 that have the set-system-time plugin enabled are affected. The issue manifests on any installation of the signalk-server where the plugin is active, typically on the central data hub that aggregates vessel information via WebSocket.

The CVSS base score is 10, indicating the worst possible severity. The EPSS score of 10% suggests a non‑negligible likelihood that attackers will attempt this exploit. Although it is not yet listed in the CISA KEV catalog, the combination of a high CVSS, a 10% EPSS, and the ability to exploit from both authenticated and unauthenticated contexts through WebSocket messages points to a high risk that is likely exploitable in operational environments where the set-system-time plugin is enabled and security is misconfigured or turned off.