Starlink Router Gen 3 CVE-2026-19918

Q: What is the CVSS score of CVE-2026-19918?

CVE-2026-19918 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

LOW

Incorrect Privilege Assignment (CWE-266)

2026-08-16 cna@vuldb.com

Information Disclosure

2.1

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.1 LOW

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Adjacent-only vector and no authentication required per CVSS 4.0 source; partial CIA impact with no scope change to subsequent systems confirmed.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 00:29 vuln.today

DescriptionCVE.org

A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component gRPC Management Interface. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper access controls in the gRPC Management Interface of SpaceX Starlink Router Gen 3 (firmware 2025.11.14.mr64708.3) permit adjacent-network attackers to invoke the get_status function without authentication, exposing router state information and enabling limited unauthorized modifications. Exploitation is constrained to the local network segment, but a public proof-of-concept exists (confirmed by CVSS 4.0 E:P modifier). SpaceX did not respond to coordinated disclosure, leaving no vendor-issued patch or official advisory as of the time of analysis.

Technical ContextAI

The affected component is the gRPC Management Interface on the Starlink Gen 3 router, specifically the get_status RPC function. gRPC is a high-performance remote procedure call framework built on HTTP/2 and Protocol Buffers, commonly used for device management APIs in consumer and enterprise networking hardware. CWE-266 (Incorrect Privilege Assignment) indicates that the get_status function fails to enforce caller-identity or authorization checks before returning or modifying router state - any caller reachable on the LAN can invoke the function regardless of privilege level. The ararasat.com reference provides additional technical detail on the Starlink LAN gRPC control surface, suggesting this interface is accessible by default on the router's local network side. No CPE string was included in the provided NVD data.

Affected ProductsAI

SpaceX Starlink Router Gen 3 running firmware version 2025.11.14.mr64708.3 is the confirmed affected product per the CVE description. No CPE string was provided in the source data, and no vendor advisory exists as SpaceX did not respond to the coordinated disclosure by CNA cna@vuldb.com. Whether earlier or later Gen 3 firmware versions are affected is not confirmed from available data. The VulDB entry at https://vuldb.com/vuln/390168 is the primary public reference, with supplementary technical analysis of the Starlink LAN gRPC interface available at https://www.ararasat.com/blog/starlink-lan-grpc-control/.

RemediationAI

No vendor-released patch has been identified at time of analysis - SpaceX did not respond to disclosure, and no official advisory or fix version exists. The primary compensating control is network segmentation: restrict access to the router's LAN-side gRPC management port by isolating the router management interface from untrusted LAN clients, using VLAN separation or firewall rules to permit only authorized management hosts to reach the relevant ports. In shared or semi-public Starlink deployments (e.g., community or business installations), enable client isolation features on the wireless access point to prevent LAN-adjacent lateral movement between clients and the router management interface - note this may also restrict legitimate peer-to-peer traffic between network users. Monitor the VulDB submission at https://vuldb.com/vuln/390168 and https://vuldb.com/vuln/390168/cti for updates, and watch the ararasat.com research blog for community-developed mitigations or firmware reverse-engineering findings. If SpaceX releases a firmware update, prioritize applying it promptly given the absence of prior vendor engagement.