---
title: "CVE-2025-66398: Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)"
url: https://erroneo.us/security/cve/CVE-2025-66398/
description: "CVE-2025-66398 (signalk-server (npm)): Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-01-01
date_modified: 2026-04-27
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-66398"
kev: false
cvss: 9.7
epss: 0.1985
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-66398: Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

**Signal:** High exploit likelihood. EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 19.9% , percentile 97: FIRST’s model estimates a 19.9% chance of exploitation activity in the next 30 days, higher than 97% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
- Only applies if your dependency tree includes signalk-server (npm) < 2.19.0, fixed in 2.19.0 . Check your lockfile, including transitive dependencies.

## What it is

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (restoreFilePath) of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files (e.g., security.json, package.json), leading to account takeover and Remote Code Execution (RCE). Version 2.19.0 patches this vulnerability.

## Affected packages

- npm `signalk-server` < 2.19.0 → fixed: 2.19.0

## Affected products (CVE record)

- SignalK signalk-server: < 2.19.0

## Severity

- GitHub_M CVSS 3.1: 9.7 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 19.85% probability of exploitation activity in the next 30 days; percentile 97.

## Sources

- [GitHub Advisory GHSA-w3x5-7c4c-66p9](https://github.com/advisories/GHSA-w3x5-7c4c-66p9)
- [CVE.org record CVE-2025-66398](https://www.cve.org/CVERecord?id=CVE-2025-66398)
- [NVD entry CVE-2025-66398](https://nvd.nist.gov/vuln/detail/CVE-2025-66398)
- [github.com](https://github.com/SignalK/signalk-server/security/advisories/GHSA-w3x5-7c4c-66p9)
- [github.com](https://github.com/SignalK/signalk-server/releases/tag/v2.19.0)
- [github.com](https://github.com/SignalK/signalk-server/commit/5c211eaf33f0ccadbaed6720264780d92afbd7f8)

---
Source page: https://erroneo.us/security/cve/CVE-2025-66398/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt