Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent admin accounts for full server control.

Etkilenen sürümler1 yazılım

Kaynaklar8 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…server/security/advisories/GHSA-4w32-qx5g-cpwv Üretici bülteni
• github.com/…ommit/728bab82742d16c54e50525b95dc9b6e32396107 Yama
• vulncheck.com/….0-missing-authentication-via-skserver-ziplogs Üçüncü taraf
• github.com/SignalK/signalk-server Diğer
• github.com/…server/blob/v2.32.0/src/interfaces/logfiles.js Diğer
• github.com/SignalK/signalk-server/releases/tag/v2.33.0 Diğer

Kayıt geçmişi

1. 29 Eki 2026 00:11Yayımlandı

İlgili açıklar

• 4,2 CVE-2026-115752Signal K Server'da App Store simge alıcısında sunucu taraflı istek sahteciliği (SSRF) açığı
• 7,3 CVE-2026-61571AVideo-Encoder: missing authentication on control and status endpoints
• 8,6 CVE-2026-61542Gearboy advisory / Gearsystem body: Unauthenticated network exposure of MCP HTTP tools
• 9,4 CVE-2026-63190FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
• 9,8 CVE-2026-103409Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed
• 9,4 CVE-2026-112197Missing Authentication for Critical Function in Tactis' NoviGest Desktop App