Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-time plugin is enabled. Unauthenticated users can also exploit this vulnerability if security is disabled on the Signal K server. This occurs due to unsafe construction of shell commands when processing navigation.datetime values received via WebSocket delta messages. This vulnerability is fixed in 1.5.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-02 | 2 | Disclosure2 |
| 2026-02-03 | 3 | Disclosure1Patch2 |
| 2026-03-02 | 1 | General1 |
📌 Top CVEs recientes (CVSS>=7.0): 1. 🛡️ CVE-2026-25221 (CVSS: 8.1) 2. ⚠️ CVE-2026-25134 (CVSS: 8.8) 3. ⚠️ CVE-2026-23515 (CVSS: 9.9) 4. 🕷️ CVE-2025-13096 (CVSS: 7.1) 5. ⚠️ CVE-2026-22229 (CVSS: 7.2) #CyberSecurity #CVE #Infosec
Post summary
The text lists several recent CVEs with high CVSS scores but provides no additional details on exploitation, patches, or technical specifics.
The Signal K Set-System-Time plugin has an RCE vulnerability via command injection (CVE-2026-23515). This affects systems using the plugin. Update to 1.5.0. #SignalK #RCE #CommandInjection https://www.pulsepatch.io/posts/cve-2026-23515-signal-k-set-system-time-rce-command-injection
Post summary
The post alerts users to an RCE vulnerability (CVE-2026-23515) in the Signal K Set‑System‑Time plugin and recommends updating to version 1.5.0 to remediate the issue.
CVE-2026-23515 Command Injection Vulnerability in Signal K Server Prior ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-23515 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The post announces CVE-2026-23515, a command injection vulnerability in Signal K Server, and links to a Vulmon page for further details while encouraging vulnerability scanning.
[CVE-2026-23515: CRITICAL] Signal K Server <1.5.0 allows authenticated users to execute shell commands. Unauthenticated users can exploit this if security is disabled. Update to 1.5.0 to fix this.#cve,CVE-2026-23515,#cybersecurity https://cvefind.com/CVE-2026-23515
Post summary
Signal K Server <1.5.0 allows authenticated users to execute shell commands and unauthenticated users when security is disabled; updating to 1.5.0 fixes the vulnerability.
CVE-2026-23515 Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write … https://www.cve.org/CVERecord?id=CVE-2026-23515
Post summary
The note announces a command injection flaw in Signal K Server (pre‑1.5.0) with no additional exploit, patch, or active‑use information.
🚨 CVE-2026-23515: RCE - Command Injection in Signa... Maritime mayhem: WebSocket delta messages in set-system-time plugin allow shell command injection via navigation.dateti... https://zerodaysignal.com/vulnerability/CVE-2026-23515 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE-2026-23515, describing a remote code execution vulnerability caused by command injection in Signa’s set‑system‑time plugin via WebSocket delta messages. No PoC, exploit tool, active exploitation, patch, or debunking information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | signalk | signal_k_server | - | - | - |