CVE-2025-67780

SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation, and elevation data via gRPC can make it easier to infer the geographical location of the dish. NOTE: this is disputed by the Supplier because unauthenticated LAN gRPC is intended behavior for certain mobile app integration, and because the cross-origin policy is correctly enforced for gRPC-Web (port 9201), i.e., it is not a valid vulnerability report.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.akawlabs.com/blog/starlink-grpc-execution

Configurations

No configuration.

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Dispositivos SpaceX Starlink Dish con firmware 2024.12.04.mr46620 (p. ej., en Mini1_prod2) permiten acciones administrativas a través de solicitudes gRPC LAN no autenticadas, también conocido como MARMALADE 2. La política de origen cruzado puede ser eludida al omitir un encabezado Referer. En algunos casos, la capacidad de un atacante para leer datos de inclinación, rotación y elevación a través de gRPC puede facilitar la inferencia de la ubicación geográfica de la antena.

Information

Published : 2025-12-11 23:15

Updated : 2026-10-07 20:10

NVD link : CVE-2025-67780

Mitre link : CVE-2025-67780

CVE.ORG link : CVE-2025-67780

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2025-67780", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67780", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T15:26:43.134767Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "SpaceX", "product": "Starlink Dish", "versions": [{"status": "affected", "version": "2024.12.04.mr46620", "lessThan": "21.08.24", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-12-11T23:15:51.033", "references": [{"url": "https://www.akawlabs.com/blog/starlink-grpc-execution", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation, and elevation data via gRPC can make it easier to infer the geographical location of the dish. NOTE: this is disputed by the Supplier because unauthenticated LAN gRPC is intended behavior for certain mobile app integration, and because the cross-origin policy is correctly enforced for gRPC-Web (port 9201), i.e., it is not a valid vulnerability report."}, {"lang": "es", "value": "Dispositivos SpaceX Starlink Dish con firmware 2024.12.04.mr46620 (p. ej., en Mini1_prod2) permiten acciones administrativas a trav\u00e9s de solicitudes gRPC LAN no autenticadas, tambi\u00e9n conocido como MARMALADE 2. La pol\u00edtica de origen cruzado puede ser eludida al omitir un encabezado Referer. En algunos casos, la capacidad de un atacante para leer datos de inclinaci\u00f3n, rotaci\u00f3n y elevaci\u00f3n a trav\u00e9s de gRPC puede facilitar la inferencia de la ubicaci\u00f3n geogr\u00e1fica de la antena."}], "lastModified": "2026-10-07T20:10:01.970", "sourceIdentifier": "cve@mitre.org"}