CVE-2025-67780 describes a missing authentication vulnerability (CWE-306) in SpaceX Starlink Dish devices running firmware 2024.12.04.mr46620. The issue allows unauthenticated LAN gRPC requests to perform administrative actions. Additionally, the cross-origin policy can be bypassed by omitting the Referer header, which may allow an attacker to read device orientation data (tilt, rotation, elevation) via gRPC, potentially aiding in inferring the device's location. However, the vendor disputes the classification of this behavior as a vulnerability, citing intended design for mobile app integration and proper enforcement of cross-origin policy on gRPC-Web port 9201.

The vulnerability could allow an unauthenticated attacker on the local network to perform administrative actions on the Starlink Dish device and access orientation data that might reveal the device's location. The CVSS score of 4.2 indicates a medium severity with low confidentiality impact but some availability impact. No known exploits are reported in the wild. The vendor disputes the vulnerability claim, indicating the behavior is by design for certain integrations.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor states that unauthenticated LAN gRPC access is intended behavior and cross-origin policy is enforced correctly for gRPC-Web, no immediate action may be required. Users should monitor vendor communications for updates or patches addressing this issue.