This vulnerability affects the SpaceX Starlink Router Gen 3 firmware version 2025.11.14.mr64708.3. The flaw exists in the get_status function of the gRPC Management Interface component, where improper access controls allow an attacker on the local network to access or manipulate information that should be restricted. The vulnerability is classified under CWE-266 (Incorrect Access Control) and CWE-284 (Improper Access Control). The attack vector is local network (AV:A), with low attack complexity and no privileges or user interaction required. The vendor was contacted but did not respond, and no patch or mitigation has been published.

An attacker with access to the local network can exploit this vulnerability to bypass access controls in the router's management interface, potentially gaining unauthorized access to status information or management functions. This could lead to information disclosure or unauthorized management actions within the local network environment. There is no evidence of active exploitation in the wild.

No official patch or fix is currently available from the vendor. Since the vulnerability requires local network access, restricting physical and wireless network access to trusted users and devices can reduce risk. Monitor for unusual activity on the local network and consider network segmentation to limit access to the router's management interface. Check for any future vendor advisories or firmware updates addressing this issue.