PT-2024-14499 · Spacex · Spacex Starlink Wi-Fi Router Gen 2+1

Bobdoduk · Published 2024-04-05 · Updated 2025-03-13 · CVE-2023-52235

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SpaceX Starlink Wi-Fi router GEN 2 versions prior to 2023.53.0 SpaceX Starlink Dish versions prior to 07dd2798-ff15-4722-a9ee-de28928aed34

Description The issue allows for CSRF via a DNS Rebinding attack, which can be used for actions such as rebooting the device.

Recommendations For SpaceX Starlink Wi-Fi router GEN 2 versions prior to 2023.53.0, update to version 2023.53.0 or later. For SpaceX Starlink Dish versions prior to 07dd2798-ff15-4722-a9ee-de28928aed34, update to version 07dd2798-ff15-4722-a9ee-de28928aed34 or later.

Fix

Weakness Enumeration

CWE-350

Related Identifiers

CVE-2023-52235

Affected Products

Spacex Starlink Dish

Spacex Starlink Wi-Fi Router Gen 2

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-52235 · Security Note
• https://twitter.com/byteshiva/status/1859437246274736388 · Twitter Post
• https://bugcrowd.com/disclosures/f529009b-90eb-4bf9-957d-6fe7ea890fa2/starlink-dishy-is-vulnerable-to-csrf-via-dns-rebinding · Note
• https://t.me/cvenotify/75801 · Telegram Post
• https://t.me/cvenotify/114752 · Telegram Post