PT-2023-9152 · Spacex · Spacex Starlink Wi-Fi Router Gen 2

Hackintoanetwork + 1 · Publicado 2023-10-10 · Atualizado 2025-03-27 · CVE-2023-49965

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions SpaceX Starlink Wi-Fi router Gen 2 versions prior to 2023.48.0

Description The issue is related to the lack of protection of the web page structure, allowing a remote attacker to conduct a cross-site scripting (XSS) attack via the ssid and password parameters on the Setup Page.

Recommendations For SpaceX Starlink Wi-Fi router Gen 2 versions prior to 2023.48.0, update to version 2023.48.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Setup Page until a patch is available. Avoid using the parameters ssid and password in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

CSRF

Enumeração de Fraquezas

CWE-79

CWE-352

Identificadores relacionados

BDU:2024-04185

CVE-2023-49965

Produtos afetados

Spacex Starlink Wi-Fi Router Gen 2

Referências · 10

• 🔥❌ https://github.com/hackintoanetwork/SpaceX-Starlink-Router-Gen-2-XSS · Exploit, Deleted
• https://twitter.com/CVEnew/status/1776242950730617199 · Publicação no Twitter
• https://t.me/cvenotify/75835 · Publicação no Telegram
• https://hackintoanetwork.com/blog/2023-starlink-router-gen2-xss-eng · Nota
• https://bdu.fstec.ru/vul/2024-04185 · Nota de Segurança
• https://vuldb.com/?id.259495 · Nota
• https://t.me/cvenotify/116561 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-49965 · Nota de Segurança
• https://t.me/cvenotify/91777 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1776303919381016731 · Publicação no Twitter