Signal K Server contains a flaw that permits an unauthenticated user to invoke the /enableSecurity endpoint and inject an administrative role. This bypasses all authentication checks and elevates the attacker to full Administrator level, allowing control over vessel routing data, server configuration, and access to sensitive endpoints, thereby compromising the integrity and availability of the vessel’s systems.

Signal K Server, produced by SignalK, is affected in all releases prior to 2.24.0-beta.4, including the beta1, beta2, and beta3 builds. The vulnerability is fixed in version 2.24.0-beta.4 and later.

The flaw carries a CVSS score of 9.4, indicating a critical severity. However, the EPSS score is below 1%, suggesting a low current exploitation probability. It is not listed in CISA’s KEV catalog. An attacker can exploit this remotely by sending an HTTP request to the /enableSecurity endpoint from any network segment that can reach the server, which poses a significant risk for vessels with exposed or unprotected network access.