Answer in brief
CVE-2025-67780 records a Medium severity (CVSS 4.2) vulnerability in CISA ADP Vulnrichment. The current sources do not mark it as known exploited. The current feed maps SpaceX/Starlink Dish (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps SpaceX/Starlink Dish (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| SpaceX/Starlink Dishgeneric | >=2024.12.04.mr46620 <21.08.24 | 21.08.24 |
Published upstream
Dec 11, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 9, 2026
SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation, and elevation data via gRPC can make it easier to infer the geographical location of the dish. NOTE: this is disputed by the Supplier because unauthenticated LAN gRPC is intended behavior for certain mobile app integration, and because the cross-origin policy is correctly enforced for gRPC-Web (port 9201), i.e., it is not a valid vulnerability report.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2025-67780 records a Medium severity (CVSS 4.2) vulnerability in CISA ADP Vulnrichment. The current sources do not mark it as known exploited. The current feed maps SpaceX/Starlink Dish (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps SpaceX/Starlink Dish (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| SpaceX/Starlink Dishgeneric | >=2024.12.04.mr46620 <21.08.24 | 21.08.24 |
Published upstream
Dec 11, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 9, 2026
SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation, and elevation data via gRPC can make it easier to infer the geographical location of the dish. NOTE: this is disputed by the Supplier because unauthenticated LAN gRPC is intended behavior for certain mobile app integration, and because the cross-origin policy is correctly enforced for gRPC-Web (port 9201), i.e., it is not a valid vulnerability report.
Quoted source text, attributed separately from HOL analysis.