CVE-2025-69203: Signal K Server Access Request Spoofing Vulnerability
Summary
CVE-2025-69203: Signal K Server Vulnerable to Access Request Spoofing. Affects signalk-server versions < 2.19.0. Fixed in 2.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Signal K Server is an open-source platform designed for marine data management, allowing devices to communicate and share information in real-time. It provides a framework for integrating various marine sensors and systems, enabling users to monitor and control their vessels effectively. However, the server has a vulnerability in its access request system that can be exploited for unauthorized access.
Vulnerability Detail
The vulnerability arises from the Signal K Server's handling of access requests, where it allows devices to specify a 'description' and 'permissions' field. Attackers can exploit this by requesting elevated permissions (like 'admin') while providing a misleading description that suggests limited access. Additionally, the server trusts the 'X-Forwarded-For' HTTP header without validation, enabling attackers to spoof their IP address, making malicious requests appear to originate from trusted internal networks. This combination can lead to social engineering attacks, where administrators may inadvertently grant elevated permissions to attackers posing as legitimate devices.
How To Fix
Minimum fixed version
2.19.0
This is the first release that contains the fix.
npm install signalk-server@2.19.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement logging for both the 'X-Forwarded-For' header and the actual connection IP address for audit purposes. This will help identify any spoofed requests. Furthermore, consider whitelisting known device IP addresses to prevent unauthorized access requests.
Conclusion
The CVE-2025-69203 vulnerability in Signal K Server poses a significant risk by allowing access request spoofing. By updating to the patched version and implementing recommended security measures, administrators can protect their systems from potential exploitation.
See every vulnerability recorded for signalk-server →
FAQ
CVE-2025-69203 is a vulnerability in the Signal K Server that allows attackers to spoof access requests, potentially gaining unauthorized admin privileges.
If you are using a version of Signal K Server prior to 2.19.0, you are at risk. You can check your version in the package-lock.json file.
An attacker could gain elevated permissions by spoofing their device's identity and IP address, leading to unauthorized access and control over the server.
Update to version 2.19.0 or later and implement validation for 'X-Forwarded-For' headers. Additionally, consider whitelisting known device IP addresses.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just the package-lock.json file. You can check your application for vulnerabilities using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for signalk-server.
