CVE-2017-13718: n/a vulnerability

CVE-2017-13718: The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup by the user...

The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup by the user on the device, and this allows an attacker to change the Wi-Fi settings and PIN, as well as port forward and expose any internal device's port to the Internet. It was identified that the device uses custom Python code called "rodman" that allows the mobile appication to interact with the device. The APIs that are a part of this rodman Python file allow the mobile application to interact with the device using a secret, which is a uuid4 based session identifier generated by the device the first time it is set up. However, in some cases, these APIs can also use a security code. This security code is nothing but the PIN number set by the user to interact with the device when using the touch interface on the router. This allows an attacker on the Internet to interact with the router's HTTP interface when a user navigates to the attacker's website, and brute force the credentials. Also, since the device's server sets the Access-Control-Allow-Origin header to "*", an attacker can easily interact with the JSON payload returned by the device and steal sensitive information about the device.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 5, 2024, 19:05 UTC (UTC+00:00)

Security readout for executives and security teams

This issue affects Starry Station, also called Starry Router. A website visited by a user could interact with the router's HTTP API, try to guess the user's PIN, and then change Wi-Fi settings, change the PIN, or expose internal device ports to the Internet. Exposure is limited to environments using Starry Station or Starry Router devices. The supplied CVE data does not identify affected firmware versions, supported status, or CPEs, so asset validation must rely on device inventory and vendor documentation. Treat this as high priority where Starry routers remain in service. The main business risk is loss of network control and accidental Internet exposure of internal devices. Urgency is lower if no affected devices are present. Mitigation focus: Check Starry or vendor guidance for firmware updates or replacement advice.; Retire or replace unsupported Starry Station or Starry Router devices.; Disable exposed router management interfaces where configuration permits..

Prepared: Jun 6, 2026, 20:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup

cve · low confidence lookup

CVE-2017-13718 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Jun 10, 2019, 21:31 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
20190609 Newly releases IoT security issuesCVE reference · mailing-list, x_refsource_BUGTRAQ
https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdfCVE reference · x_refsource_MISC

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.