CVE-2025-66398

CRITICAL

Signal K Server < 2.19.0 - Unauthenticated Remote Code Execution via Backup Validation Endpoint

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-66398. PoCs published by joshuavanderpoll, showy-headteacher114.

AI-analyzed exploit summary The repository contains functional exploit code for CVE-2025-66398, with both Go and Python implementations. The presence of a GitHub Actions workflow for building and releasing binaries suggests a mature and functional PoC.

Description

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., `security.json`, `package.json`), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.

Exploits (2)

nomisec WORKING POC 1 stars
by joshuavanderpoll · poc
https://github.com/joshuavanderpoll/cve-2025-66398

The repository contains functional exploit code for CVE-2025-66398, with both Go and Python implementations. The presence of a GitHub Actions workflow for building and releasing binaries suggests a mature and functional PoC.

Classification
Working Poc 90%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: unknown
No auth needed
Prerequisites: unknown
devstral-2 · analyzed Mar 11, 2026 Full analysis →
nomisec WORKING POC
by showy-headteacher114 · poc
https://github.com/showy-headteacher114/cve-2025-66398

The repository contains functional exploit code for CVE-2025-66398, with both Go and Python implementations. The presence of Docker files suggests a test environment setup for validation.

Classification
Working Poc 80%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: unknown
No auth needed
Prerequisites: Docker environment for testing
devstral-2 · analyzed Mar 24, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 9.6
EPSS 0.0016
EPSS Percentile 37.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-78 CWE-913
Status published
Products (2)
npm/signalk-server 0 - 2.19.0npm
signalk/signal_k_server < 2.19.0
Published Jan 01, 2026
Tracked Since Feb 18, 2026