CVE-2017-13718

The HTTP API supported by Starry Station (aka Starry Router) allows brute forcing the PIN setup by the user on the device, and this allows an attacker to change the Wi-Fi settings and PIN, as well as port forward and expose any internal device's port to the Internet. It was identified that the device uses custom Python code called "rodman" that allows the mobile appication to interact with the device. The APIs that are a part of this rodman Python file allow the mobile application to interact with the device using a secret, which is a uuid4 based session identifier generated by the device the first time it is set up. However, in some cases, these APIs can also use a security code. This security code is nothing but the PIN number set by the user to interact with the device when using the touch interface on the router. This allows an attacker on the Internet to interact with the router's HTTP interface when a user navigates to the attacker's website, and brute force the credentials. Also, since the device's server sets the Access-Control-Allow-Origin header to "*", an attacker can easily interact with the JSON payload returned by the device and steal sensitive information about the device.

• CWE-254

• http://packetstormsecurity.com/files/153240/Starry-Router-Camera-PIN-Brute-Force-CORS-Incorrect.htmlThird Party Advisory, VDB Entry
• https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdfExploit, Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/153240/Starry-Router-Camera-PIN-Brute-Force-CORS-Incorrect.htmlThird Party Advisory, VDB Entry
• https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdfExploit, Third Party Advisory
• https://seclists.org/bugtraq/2019/Jun/8Mailing List, Third Party Advisory

Published

Jun 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-13711Use-after-free vulnerability in the sofree function in slirp…7.5
• CVE-2017-13712NULL Pointer Dereference in the id3v2AddAudioDuration functi…
• CVE-2017-13713T&W WIFI Repeater BE126 allows remote authenticated users to…
• CVE-2017-13715The __skb_flow_dissect function in net/core/flow_dissector.c…9.8
• CVE-2017-13716The C++ symbol demangler routine in cplus-dem.c in libiberty…
• CVE-2017-13717Starry Station (aka Starry Router) sets the Access-Control-A…
• CVE-2017-13719The Amcrest IPM-721S Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R…
• CVE-2017-1372IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 is vulner…
• CVE-2017-13720In the PatternMatch function in fontfile/fontdir.c in libXfo…
• CVE-2017-13721In X.Org Server (aka xserver and xorg-server) before 1.19.4,…
• CVE-2017-13722In the pcfGetProperties function in bitmap/pcfread.c in libX…
• CVE-2017-13723In X.Org Server (aka xserver and xorg-server) before 1.19.4,…