CVE-2017-13717 - Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*"

Back Back to CVE browser

HIGH

Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*"

Published Jun 10, 2019

8.8

HIGH

CVSS 3.0

EPSS 2.55%

Description

Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*". This allows any hosted file on any domain to make calls to the device's webserver and brute force the credentials and pull any information that is stored on the device. In this case, a user's Wi-Fi credentials are stored in clear text on the device and can be pulled easily.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-255

References (3)

http://packetstormsecurity.com/files/153240/Starry-Router-Camera-PIN-Brute-Force-CORS-Incorrect.html
x_refsource_MISCThird Party AdvisoryVDB Entry
https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdf
x_refsource_MISCExploitThird Party Advisory
https://seclists.org/bugtraq/2019/Jun/8
mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/153240/Starry-Router-Camera-PIN-Brute-Force-CORS-Incorrect.html		x_refsource_MISCThird Party AdvisoryVDB Entry
https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdf		x_refsource_MISCExploitThird Party Advisory
https://seclists.org/bugtraq/2019/Jun/8		mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 10, 2019

Updated Aug 5, 2024

Reserved Aug 28, 2017

Link CVE-2017-13717

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-13717

Red Hat

Severity n/a

Public date n/a

Links CVE-2017-13717