CVE-2017-13717

Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*". This allows any hosted file on any domain to make calls to the device's webserver and brute force the credentials and pull any information that is stored on the device. In this case, a user's Wi-Fi credentials are stored in clear text on the device and can be pulled easily.

• CWE-255

• http://packetstormsecurity.com/files/153240/Starry-Router-Camera-PIN-Brute-Force-CORS-Incorrect.htmlThird Party Advisory, VDB Entry
• https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdfExploit, Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/153240/Starry-Router-Camera-PIN-Brute-Force-CORS-Incorrect.htmlThird Party Advisory, VDB Entry
• https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdfExploit, Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory

Published

Jun 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-13710The setup_group function in elf.c in the Binary File Descrip…
• CVE-2017-13711Use-after-free vulnerability in the sofree function in slirp…7.5
• CVE-2017-13712NULL Pointer Dereference in the id3v2AddAudioDuration functi…
• CVE-2017-13713T&W WIFI Repeater BE126 allows remote authenticated users to…
• CVE-2017-13715The __skb_flow_dissect function in net/core/flow_dissector.c…9.8
• CVE-2017-13716The C++ symbol demangler routine in cplus-dem.c in libiberty…
• CVE-2017-13718The HTTP API supported by Starry Station (aka Starry Router)…
• CVE-2017-13719The Amcrest IPM-721S Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R…
• CVE-2017-1372IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 is vulner…
• CVE-2017-13720In the PatternMatch function in fontfile/fontdir.c in libXfo…
• CVE-2017-13721In X.Org Server (aka xserver and xorg-server) before 1.19.4,…
• CVE-2017-13722In the pcfGetProperties function in bitmap/pcfread.c in libX…