Security readout for executives and security teams
Plain-English summary
A device on the same local network as some Starlink dishes may be able to request administrative or telemetry functions without logging in. The reported impact is limited, but could affect availability or reveal orientation data that may help infer location. SpaceX disputes that this is a vulnerability.
Executive priority
Treat this as a moderate, environment-dependent risk. It matters most for mobile, shared, guest, or field networks where untrusted devices can reach Starlink equipment. Prioritize inventory and segmentation before emergency response, because active exploitation and an official fix are not established in the provided sources.
Technical view
The CVE describes unauthenticated LAN gRPC administrative actions on Starlink Dish firmware 2024.12.04.mr46620, labeled MARMALADE 2. It also alleges cross-origin policy bypass by omitting a Referer header and possible location inference from dish orientation telemetry. SpaceX disputes validity, saying unauthenticated LAN gRPC is intended for mobile app integration and gRPC-Web origin controls work.
Likely exposure
Organizations using Starlink Dish firmware 2024.12.04.mr46620, including Mini1_prod2 examples, where untrusted devices share LAN access. Exposure appears adjacent-network or local-network, not Internet-wide, based on the CVSS vector and LAN gRPC description. Product and version coverage beyond the named firmware is unknown.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. Practical exploitation would require access to the same local or adjacent network and is rated high complexity. Public reporting exists, but the supplier disputes the vulnerability interpretation and states the relevant behavior is intended in some integration paths.
Researcher notes
Key uncertainty is the supplier dispute: the reported unauthenticated LAN gRPC behavior may be intentional for app integration. Validate only against owned devices and avoid assuming broader Starlink models or firmware are affected. The CVSS vector indicates adjacent access, high complexity, low confidentiality impact, and low availability impact.
Mitigation direction
- Check SpaceX or Starlink guidance for official firmware and configuration recommendations.
- Keep Starlink dish firmware current where managed updates are available.
- Do not place untrusted clients on the same LAN as dish management paths.
- Use network segmentation or guest Wi-Fi separation where operationally feasible.
- Monitor vendor communications because the report is disputed and affected scope is narrow.
Validation and detection
- Inventory Starlink Dish devices and record firmware versions.
- Identify networks where Starlink dishes share LAN access with untrusted clients.
- Review whether 2024.12.04.mr46620 or named Mini1_prod2 examples are present.
- Confirm whether compensating network segmentation limits adjacent client access.
- Track the CVE record and vendor statements for scope or remediation changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-67780 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L1.62.5mitreVulnerability scoring details
Base CVSS 3.1 score
4.2MediumVector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.akawlabs.com/blog/starlink-grpc-executionCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.