Signal K Server <= 2.18.0 - Information Disclosure
Signal K Server versions up to and including 2.18.0 expose the /skServer/serialports, /skServer/availablePaths, and /skServer/hasAnalyzer endpoints without authentication. These routes were missing from the authentication middleware configuration, letting any unauthenticated user retrieve the full Signal K data schema, the list of connected serial devices, and whether traffic analyzer tools are installed. This template fingerprints the server via the public /signalk discovery endpoint and flags builds older than the fixed 2.19.0 release.
PoC 已收录Signal K Server
CVSS5.3EPSS 0.82%