CVE-2023-52235

The SpaceX Starlink Wi-Fi router and dish contain a security flaw that allows attackers to trick your browser into sending unwanted commands (like reboot requests) to your device through DNS manipulation. This happens because the devices don't properly verify that requests actually come from legitimate sources.

The vulnerability exploits insufficient CSRF protection in Starlink Gen 2 router and dish interfaces, leveraging DNS rebinding to bypass same-origin policies. An attacker can craft malicious websites that, when visited by an authenticated user, trigger unauthorized administrative actions such as device reboots without user consent. Affected versions: router before 2023.53.0 and specific dish firmware versions.