| 제목 | Spacex - Starlink Starlink Router Gen 3 2025.11.14.mr64708.3 Improper Access Controls |
|---|
| 설명 | The SpaceX Starlink Router Gen 3 (firmware 2025.11.14.mr64708.3) suffers from an unauthenticated access control vulnerability on its local gRPC management interface (TCP/9000).
Specifically, the endpoint SpaceX.API.Device.Device/Handle fails to validate permissions or require any form of authentication before processing incoming requests. Because of this, anyone connected to the local network (LAN or WLAN) can send crafted gRPC messages to execute privileged administrative actions.
During testing, it was possible to force device reboots, trigger the dish stow operation, and initiate a full factory reset. The flaw also allows an attacker to dump sensitive telemetry and internal network topology data using the get_status method. Exploitation requires no user interaction or prior privileges, just local network access. |
|---|
| 원천 | ⚠️ https://www.ararasat.com/blog/starlink-lan-grpc-control/ |
|---|
| 사용자 | 0dallen (UID 99328) |
|---|
| 제출 | 2026. 06. 26. PM 05:13 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 15. AM 07:13 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 390168 [SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3 gRPC Management Interface get_status 권한 상승] |
|---|
| 포인트들 | 20 |
|---|