CVE-2017-13717: Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*".

Security readout for executives and security teams

This flaw concerns Starry Station, also known as Starry Router. The device reportedly allowed any website to interact with its local webserver because it used a wildcard CORS policy. That could let a malicious webpage attempt credential attacks and retrieve stored device information, including clear-text Wi-Fi credentials. Exposure is likely limited to environments that still use Starry Station or Starry Router devices whose webserver is reachable from users' browsers. Evidence does not establish internet-wide exposure or affected firmware ranges. Prioritize this only where Starry devices exist. For those environments, treat it as urgent because compromise could expose Wi-Fi credentials and device data. If no Starry devices are present, no direct action is indicated beyond asset confirmation. Mitigation focus: Inventory networks for Starry Station or Starry Router devices.; Check Starry or vendor guidance for firmware updates, replacement, or retirement.; Restrict router management access to trusted administrator networks..

Prepared

Jun 6, 2026, 20:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.