9.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-66398

CVE-2025-66398: Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (restoreFilePath) of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., security.json, package.json), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-66398

CVE-2025-66398:

9.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
signalk-server	npm	< 2.19.0	2.19.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability consists of a two-stage attack. First, an unauthenticated attacker exploits a state pollution vulnerability. The /skServer/validateBackup endpoint does not require authentication and modifies a global variable, restoreFilePath, which is shared across all requests. An attacker can upload a malicious backup archive and this endpoint will set restoreFilePath to the location of this archive.

The second stage involves the /skServer/restore endpoint. This endpoint uses the restoreFilePath variable to perform a system restore. By using the path polluted in the first stage, the server restores the attacker's malicious archive, allowing them to overwrite sensitive configuration files like security.json to create a backdoor administrator account.

Finally, with administrative privileges, the attacker can exploit a separate command injection vulnerability in the runNpm function, which is triggered via the app store installation feature. The runNpm function improperly constructed an npm install command by concatenating user input from the URL, allowing the attacker to execute arbitrary commands on the server, achieving Remote Code Execution (RCE). The patch addresses these issues by removing the global state in favor of a session-based mechanism for the restore process, adding authentication to the backup/restore endpoints, and fixing the command injection flaw by passing arguments as an array to the child process.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.