CVE-2026-19918
Received Received - Intake

Improper Access Control in SpaceX Starlink Router Gen 3

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulDB

Description
A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component gRPC Management Interface. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-19918

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
spacex starlink_router 2025.11.14.mr64708.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the SpaceX Starlink Router Gen 3 version 2025.11.14.mr64708.3. It involves the gRPC Management Interface function get_status, which suffers from improper access controls. The issue allows unauthorized manipulation of the router's administrative functions when accessed from within the local network.

Detection Guidance

Check if port 9000 is open on your Starlink Gen 3 router using tools like nmap. Run: nmap -p 9000 <router-ip>. If open, test unauthenticated access by connecting to the gRPC interface using a gRPC client or tools like grpcurl. Example: grpcurl -plaintext <router-ip>:9000 list.

Impact Analysis

An attacker within your local network could exploit this to reboot your router, stow the dish, perform a factory reset, or access sensitive telemetry data. This could lead to denial of service, device compromise, or exposure of network details like connected clients and firmware versions.

Compliance Impact

The vulnerability exposes sensitive telemetry data, including hardware details, firmware versions, connected client identities, and network activity. This could lead to unauthorized access to personal or sensitive information, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements for confidentiality and access controls.

Mitigation Strategies

Isolate the Starlink router from untrusted networks. Disable remote access to the gRPC interface if possible. Monitor for unauthorized changes or access. Contact SpaceX support for firmware updates or patches. If no patch is available, consider replacing the device.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19918. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart