CVE-2026-33950
🔴 Łataj teraz
Wstrzyknięcie roli administratora w Signal K Server umożliwia eskalację uprawnień.
CVSS
9.4
EPSS
0.1%
Exploit
poc
Vendor
signalk
Opis źródłowy (NVD)
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a privilege escalation vulnerability by Admin Role Injection via /enableSecurity. An unauthenticated attacker can gain full Administrator access to the SignalK server at any time, allowing them to modify sensitive vessel routing data, alter server configurations, and access restricted endpoints. This issue has been patched in version 2.24.0-beta.4.
exploit privilege-escalation
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.4 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.1% |
| Opublikowano (NVD) | 2026-04-02 17:16:22 UTC |
| Ostatnia modyfikacja (NVD) | 2026-04-06 15:04:42 UTC |
Referencje
- https://github.com/SignalK/signalk-server/releases/tag/v2.24.0-beta.4 (security-advisories@github.com) [Product, Release Notes]
- https://github.com/SignalK/signalk-server/security/advisories/GHSA-x8hc-fqv3-7gwf (security-advisories@github.com) [Exploit, Vendor Advisory]