Signal K Server: Missing authentication in ziplogs endpoint allows admin takeover

Summary

Signal K Server before 2.33.0 exposes the /skServer/ziplogs endpoint without authentication. An unauthenticated remote attacker can download a log archive that contains the JWT secret key from security.json, forge administrator tokens and create persistent admin accounts, which gives full control over the server. No authentication is required, so the risk is highest for servers reachable from the internet.

Affected

• Signal K Server versions before 2.33.0 (per CVE record: affected 0 to < 2.33.0)

Fixed in

• Upgrade to Signal K Server 2.33.0 or later. Version 2.34.0 is the current release according to the sources.

Workaround

• The project advises updating. Setting a Data Logging Directory in the server settings is mentioned as an alternative, but its effectiveness is not confirmed by the vendor.
• Keep the server off the open internet.

Exploitation

• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• OffSeq reports no known exploitation and no public exploit code. One source claims in-the-wild exploitation and KEV listing, which could not be verified.

Our recommendation

• Inventory all Signal K Server instances, including those on boats, Raspberry Pi or Victron devices.
• Update to 2.33.0 or later without delay.
• Check whether any instance was reachable from the internet, including port forwards, reverse proxies and cloud VMs.
• Review admin accounts and configuration for unexpected changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Program / VulnCheck advisory www.vulncheck.com
• GitHub Security Advisory GHSA-4w32-qx5g-cpwv github.com
• Signal K Server v2.33.0 release github.com
• Fix commit 728bab8 github.com
• Vulnerable code in logfiles.js (v2.32.0) github.com
• OffSeq threat radar entry radar.offseq.com
• Marine Review: Signal K Server 2.34.0 security update www.marine-review.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:31.