CVE-2025-67780: Spacex Starlink Dish

Medium severity, CVSS 4.2. EPSS: 0.2% chance of exploitation in the next 30 days.

SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation, and elevation data via gRPC can make it easier to infer the geographical location of the dish. NOTE: this is disputed by the Supplier because unauthenticated LAN gRPC is intended behavior for certain mobile app integration, and because the cross-origin policy is correctly enforced for gRPC-Web (port 9201), i.e., it is not a valid vulnerability report.

Affected products

• Spacex Starlink Dish: from 2024.12.04.mr46620, before 21.08.24 (fixed in 21.08.24)

Published 2025-12-11. Last modified 2026-10-07.