CVE-2025-67780: Medium severity SpaceX Starlink Dish vulnerability
SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation, and elevation data via gRPC can make it easier to infer the geographical location of the dish. NOTE: this is disputed by the Supplier because unauthenticated LAN gRPC is intended behavior for certain mobile app integration, and because the cross-origin policy is correctly enforced for gRPC-Web (port 9201), i.e., it is not a valid vulnerability report.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SpaceX Starlink Dish (MARMALADE 2)to a version that resolves this vulnerability.Fixed in 2024.12.04.mr46620Patch MARMALADE 2 - Configuration
Mitigate the reported cross-origin bypass by not allowing omission of the Referer header for gRPC-Web requests on port 9201 (MARMALADE 2), as bypass is possible by omitting Referer.
gRPC-Web (port 9201) cross-origin policy Referer header requirement = required - Compensating control
Ensure LAN gRPC used by the Starlink Dish does not accept unauthenticated requests for administrative actions (MARMALADE 2), since unauthenticated LAN gRPC requests are allowed on firmware 2024.12.04.mr46620.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67780?
CVE-2025-67780 is considered a high severity vulnerability due to its potential for unauthorized administrative access.
How do I fix CVE-2025-67780?
To remediate CVE-2025-67780, update the firmware of your SpaceX Starlink Dish to the latest version released by the vendor.
What types of devices are affected by CVE-2025-67780?
CVE-2025-67780 affects SpaceX Starlink Dish devices running firmware version 2024.12.04.mr46620.
What kind of actions can be performed with CVE-2025-67780?
CVE-2025-67780 allows attackers to perform unauthorized administrative actions via unauthenticated gRPC requests.
Is CVE-2025-67780 related to cross-origin resource sharing?
Yes, CVE-2025-67780 involves a cross-origin policy bypass by omitting the Referer header, leading to potential exploitation.