Executive brief
SpaceX Starlink Dish devices contain a configuration that allows administrative actions to be performed without authentication by devices on the same local network. An attacker with access to the local network could potentially reboot the dish, change its physical orientation (stow/tilt), or extract location-related data. While the manufacturer disputes this as a vulnerability, stating it is intended for mobile app integration, it represents a risk where local network access could lead to service disruption or unauthorized device manipulation.
Technical details
SpaceX Starlink Dish devices (specifically firmware 2024.12.04.mr46620) expose a gRPC service on port 9200 that does not require authentication for various administrative functions. This service, dubbed 'MARMALADE 2' by researchers, allows an attacker on the same LAN to send gRPC requests to perform actions such as rebooting the dish, stowing/rotating the hardware, or reading telemetry data (tilt, rotation, elevation) which can be used to infer geographical location. Additionally, the cross-origin policy on the gRPC-Web interface (port 9201) can reportedly be bypassed by omitting the Referer header. The vendor disputes the severity, claiming unauthenticated LAN access is intended for mobile app functionality and that CORS is correctly enforced for gRPC-Web.
Affected products
- SpaceX Starlink Dish 2024.12.04.mr46620
Timeline
- 2024-04-23: disclosed: Initial researcher blog post published
- 2025-12-11: advisory: CVE-2025-67780 published