CVE-2025-67780

Severity: medium (CVSS 4.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-11 · updated 2026-10-07
Weakness: CWE-306

Description

SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation, and elevation data via gRPC can make it easier to infer the geographical location of the dish. NOTE: this is disputed by the Supplier because unauthenticated LAN gRPC is intended behavior for certain mobile app integration, and because the cross-origin policy is correctly enforced for gRPC-Web (port 9201), i.e., it is not a valid vulnerability report.

Affected products

SpaceX Starlink Dish: from 2024.12.04.mr46620 before 21.08.24 — fixed in 21.08.24

How to fix

Upgrade to a fixed version: SpaceX Starlink Dish 21.08.24. Check the vendor advisory for mitigations.

References

https://www.akawlabs.com/blog/starlink-grpc-execution

Get alerted when CVE-2025-67780 or the next vulnerability affects your stack