CVE-2023-52235

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-05 · updated 2026-06-17
Weakness: CWE-350

Description

SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a reboot) via a DNS Rebinding attack.

Affected products

Spacex Starlink Wi Fi Router Gen 2: before 07dd2798-ff15-4722-a9ee-de28928aed34 — fixed in 07dd2798-ff15-4722-a9ee-de28928aed34

How to fix

Upgrade to a fixed version: Spacex Starlink Wi Fi Router Gen 2 07dd2798-ff15-4722-a9ee-de28928aed34. Check the vendor advisory for mitigations.

References

https://bugcrowd.com/disclosures/f529009b-90eb-4bf9-957d-6fe7ea890fa2/starlink-dishy-is-vulnerable-to-csrf-via-dns-rebinding
https://bugcrowd.com/disclosures/f529009b-90eb-4bf9-957d-6fe7ea890fa2/starlink-dishy-is-vulnerable-to-csrf-via-dns-rebinding

Get alerted when CVE-2023-52235 or the next vulnerability affects your stack