CVE-2025-68273 is a medium-severity security vulnerability in signalk-server (npm), affecting versions < 2.19.0. It is fixed in 2.19.0.
[Note] This is a separate issue from the RCE vulnerability (State Pollution) currently being patched. While related to tokensecurity.js, it involves different endpoints and risks. Summary An unauthenticated information disclosure vulnerability allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Details The vulnerability stems from the fact that several sensitive API endpoints are not included in the authentication middleware's protection list in src/tokensecurity.js. Vulnerable Code Analysis: Missing Protection: The tokensecurity.js file defines an array of paths that require authentication. However, the following paths defined in src/serverroutes.ts are missing from this list: /skServer/serialports /skServer/availablePaths /skServer/hasAnalyzer Unrestricted Access: Because they are missing from the protection list, the http_authorize middleware allows access to these paths even when enableSecurity is set to true. Exploit Scenario: Reconnaissance: An attacker scans the server for these endpoints. Data Extraction: Querying /skServer/availablePaths returns the full JSON schema of the vessel's data (e.g., environment.sun.sunrise, navigation.position), allowing the attacker to know exactly what data points are available for targeting. Querying /skServer/serialports reveals connected hardware (e.g., /dev/ttyUSB0), aiding in physical device targeting. PoC The following Python script demonstrates the vulnerability by querying the exposed endpoints without any authentication headers. Expected Result: The script will output [!] VULNERABLE for all three endpoints, showing snippets of the leaked JSON data. Impact Verified Information Disclosure: During our verification, we successfully retrieved the following sensitive information without any authentication: Full Data Schema: The /skServer/availablePaths endpoint returned the complete JSON schema of the vessel's data. Example: environment.sun.sunrise, navigation.position Leakage of Internal State: We also observed entries like notifications.security.accessRequest.readwrite.attacker-device-32, which revealed the presence and IDs of pending access requests (traces of our DoS attack), showing that internal server state is exposed. Hardware Configuration: The /skServer/serialports endpoint exposed the list of connected serial devices. System Capabilities: The /skServer/hasAnalyzer endpoint revealed whether traffic analysis tools were installed. This information allows an attacker to map the system's internal state and capabilities, significantly facilitating further targeted attacks (Reconnaissance). Remediation Update src/tokensecurity.js Add the missing paths to the list of protected routes in src/tokensecurity.js.
CVE-2025-68273 has a CVSS score of 5.3 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (2.19.0). Upgrading removes the vulnerable code path.
npm
signalk-server (< 2.19.0)signalk-server → 2.19.0 (npm)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's runtime-powered SCA identifies whether CVE-2025-68273 is reachable in your applications. Explore open-source security for your team.
See if CVE-2025-68273 is reachable in your applications. Get a demo
Upgrade signalk-server to 2.19.0 or later to resolve this vulnerability.
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
CVE-2025-68273 is a medium-severity security vulnerability in signalk-server (npm), affecting versions < 2.19.0. It is fixed in 2.19.0.
CVE-2025-68273 has a CVSS score of 5.3 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
signalk-server (npm) versions < 2.19.0 is affected.
Yes. CVE-2025-68273 is fixed in 2.19.0. Upgrade to this version or later.
Whether CVE-2025-68273 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
Upgrade signalk-server to 2.19.0 or later.