CVE-2017-13717 json
Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*". This allows any hosted file on any domain to make ca…
published 2019-06-10 7 y ago modified 2026-06-17 4 mo ago also EUVD-2017-5234
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*". This allows any hosted file on any domain to make calls to the device's webserver and brute force the credentials and pull any information that is stored on the device. In this case, a user's Wi-Fi credentials are stored in clear text on the device and can be pulled easily.
Exploit prediction
2.55% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdf referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-255 Credentials Management Errors
References
-
github.com
/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdf
exploit, third-party-advisory
-
seclists.org
/bugtraq/2019/Jun/8
mailing-list, third-party-advisory
-
packetstormsecurity.com
/files/153240/Starry-Router-Camera-PIN-Brute-Force-CORS-Incorrect.html
third-party-advisory, vdb-entry
Sources
- CVE List CVE-2017-13717
- NVD CVE-2017-13717
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.