| Название | Spacex - Starlink Starlink Router Gen 3 2025.11.14.mr64708.3 Improper Access Controls |
|---|
| Описание | The SpaceX Starlink Router Gen 3 (firmware 2025.11.14.mr64708.3) suffers from an unauthenticated access control vulnerability on its local gRPC management interface (TCP/9000).
Specifically, the endpoint SpaceX.API.Device.Device/Handle fails to validate permissions or require any form of authentication before processing incoming requests. Because of this, anyone connected to the local network (LAN or WLAN) can send crafted gRPC messages to execute privileged administrative actions.
During testing, it was possible to force device reboots, trigger the dish stow operation, and initiate a full factory reset. The flaw also allows an attacker to dump sensitive telemetry and internal network topology data using the get_status method. Exploitation requires no user interaction or prior privileges, just local network access. |
|---|
| Источник | ⚠️ https://www.ararasat.com/blog/starlink-lan-grpc-control/ |
|---|
| Пользователь | 0dallen (UID 99328) |
|---|
| Представление | 26.06.2026 17:13 (2 месяцы назад) |
|---|
| Модерация | 15.08.2026 07:13 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 390168 [SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3 gRPC Management Interface get_status эскалация привилегий] |
|---|
| Баллы | 20 |
|---|