Local-device action exposure through DNS rebinding
A useful boundary lesson for device teams: a browser on the same network is not a trusted caller. Action endpoints need explicit authorization and origin-aware defenses.
- Original severity
- P2 source-reported; not rescored by vulns.co
- Public source
- bugcrowd crowdstream
- Program / vendor
- SpaceX/Starlink
- Product / surface
- Starlink Dishy and router local management features
- Weakness
- Cross-site request forgery combined with DNS rebinding · CWE-352
- Affected boundary
- A device-management interface reachable from a client connected to the local network
- Disclosure date
- 2024-04-03
- Public status checked
- 2026-09-10
- Public attribution
- BoBdoduk
What the evidence established
The program summary confirms that selected unauthenticated local features could be reached from third-party web content and states the issue was patched.
Why the impact was credible
The source reported unauthorized use of selected device actions; it explicitly distinguished these from protected configuration changes.
Durable engineering lesson
A useful boundary lesson for device teams: a browser on the same network is not a trusted caller. Action endpoints need explicit authorization and origin-aware defenses.
Control pattern
Require strong request-origin validation and authentication for management actions, and do not rely on local-network reachability as a security boundary.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.