CVE-2025-69203
Published: 01 January 2026
Summary
CVE-2025-69203 is a medium-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Signalk Signal K Server. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Match Legitimate Resource Name or Location (T1036.005); ranked at the 18.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-69203 affects Signal K Server, a server application that runs on a central hub in a boat, specifically versions prior to 2.19.0 in the access request system. The vulnerability arises from two related features: the admin UI prominently displays the `description` field from access requests while making the `permissions` field less visible or separate, allowing attackers to request `admin` permissions with a misleading readonly description; and the access request handler unconditionally trusts the `X-Forwarded-For` HTTP header to determine client IP addresses, enabling IP spoofing. These issues, combined with an information disclosure vulnerability that allows enumeration of device/source names, facilitate convincing social engineering attacks against administrators.
Any network-accessible attacker without privileges can exploit this by crafting an access request that impersonates a legitimate device using an enumerated name, provides a benign `description` suggesting readonly access, requests elevated `admin` permissions, and spoofs a trusted internal IP address via the `X-Forwarded-For` header. This creates a highly convincing approval interface for administrators, who may grant the request due to the apparent legitimacy, resulting in unauthorized elevated access to the server and potential low-level impacts on confidentiality, integrity, and availability as scored by CVSS 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
Advisories recommend upgrading to Signal K Server version 2.19.0, which addresses these issues in the access request system, as detailed in the GitHub security advisory (GHSA-vfrf-vcj7-wvr8) and release notes (v2.19.0).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206135
Vulnerability details
Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.19.0 of the access request system have two related features that when combined by themselves and with an information disclosure vulnerability…
more
enable convincing social engineering attacks against administrators. When a device creates an access request, it specifies three fields: `clientId`, `description`, and `permissions`. The SignalK admin UI displays the `description` field prominently to the administrator when showing pending requests, but the actual `permissions` field (which determines the access level granted) is less visible or displayed separately. This allows an attacker to request `admin` permissions while providing a description that suggests readonly access. The access request handler trusts the `X-Forwarded-For` HTTP header without validation to determine the client's IP address. This header is intended to preserve the original client IP when requests pass through reverse proxies, but when trusted unconditionally, it allows attackers to spoof their IP address. The spoofed IP is displayed to administrators in the access request approval interface, potentially making malicious requests appear to originate from trusted internal network addresses. Since device/source names can be enumerated via the information disclosure vulnerability, an attacker can impersonate a legitimate device or source, craft a convincing description, spoof a trusted internal IP address, and request elevated permissions, creating a highly convincing social engineering scenario that increases the likelihood of administrator approval. Users should upgrade to version 2.19.0 to fix this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
UI manipulation + device name enumeration + XFF spoofing directly enable masquerading (T1036.005) to obtain valid admin accounts (T1078) via social engineering on a public-facing app (T1190), resulting in privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates unconditional trust of the X-Forwarded-For header by requiring validation of all untrusted input used for client identification and display.
Enforces that access decisions and permission grants are based on the actual requested permissions rather than misleading description text shown in the admin UI.
Requires cryptographic or authenticated device identification so that enumerated names and spoofed IPs cannot be used to impersonate legitimate devices in access requests.