SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation, and elevation data via gRPC can make it easier to infer the geographical location of the dish.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Spacex |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://www.akawlabs.com/blog/starlink-grpc-execution |
|
History
Fri, 12 Dec 2025 09:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Spacex
Spacex starlink Dish |
|
| Vendors & Products |
Spacex
Spacex starlink Dish |
Thu, 11 Dec 2025 23:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation, and elevation data via gRPC can make it easier to infer the geographical location of the dish. | SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation, and elevation data via gRPC can make it easier to infer the geographical location of the dish. |
Thu, 11 Dec 2025 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation, and elevation data via gRPC can make it easier to infer the geographical location of the dish. | |
| Weaknesses | CWE-306 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2025-12-11T23:05:44.156Z
Updated: 2025-12-11T23:12:58.232Z
Reserved: 2025-12-11T23:05:43.880Z
Link: CVE-2025-67780
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-12-11T23:15:51.033
Modified: 2025-12-12T00:15:47.390
Link: CVE-2025-67780
Redhat
No data.