PT-2023-9152 · Spacex · Spacex Starlink Wi-Fi Router Gen 2

Hackintoanetwork + 1 · Published 2023-10-10 · Updated 2025-03-27 · CVE-2023-49965

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions SpaceX Starlink Wi-Fi router Gen 2 versions prior to 2023.48.0

Description The issue is related to the lack of protection of the web page structure, allowing a remote attacker to conduct a cross-site scripting (XSS) attack via the ssid and password parameters on the Setup Page.

Recommendations For SpaceX Starlink Wi-Fi router Gen 2 versions prior to 2023.48.0, update to version 2023.48.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Setup Page until a patch is available. Avoid using the parameters ssid and password in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

BDU:2024-04185

CVE-2023-49965

Affected Products

Spacex Starlink Wi-Fi Router Gen 2

References · 10

• 🔥❌ https://github.com/hackintoanetwork/SpaceX-Starlink-Router-Gen-2-XSS · Exploit, Deleted
• https://bdu.fstec.ru/vul/2024-04185 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-49965 · Security Note
• https://twitter.com/CVEnew/status/1776242950730617199 · Twitter Post
• https://t.me/cvenotify/75835 · Telegram Post
• https://hackintoanetwork.com/blog/2023-starlink-router-gen2-xss-eng · Note
• https://vuldb.com/?id.259495 · Note
• https://t.me/cvenotify/116561 · Telegram Post
• https://t.me/cvenotify/91777 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1776303919381016731 · Twitter Post