Signal K Server before version 2.24.0-beta.1 exposes an unauthenticated HTTP endpoint that permits attackers to modify source priorities for GPS, AIS, and other navigation sensors. By sending a PUT request to /signalk/v1/api/sourcePriorities, an attacker can alter which sources the system trusts and uses for critical navigation data. The change takes effect immediately, is persisted to disk, and survives server restarts, meaning the compromised configuration remains in place until corrected. This allows a malicious actor to feed incorrect data into a vessel’s navigation stack, potentially leading to hazardous decisions or collisions. The weakness is a failure to enforce authentication and authorization, categorized as a classic access‑control violation.

The vulnerability affects all versions of the SignalK signalk-server prior to v2.24.0‑beta.1. Home‑grown deployments or ships running older releases without the patched endpoint are at risk.

The CVSS score of 6.9 indicates a medium severity vulnerability, with no EPSS data available and it is not listed in the CISA KEV catalog. The attack vector is remote over HTTP; the endpoint requires no credentials and can be accessed from any host that can reach the server. An attacker only needs network connectivity to issue a crafted PUT request. Since authentication is not enforced, exploitation is straightforward once the server is reachable, but no privilege escalation or code execution is required. Due to the persistence of the changes, the impact is long‑lasting without timely remediation.