CVE-2017-13718

The Starry Station (aka Starry Router) HTTP API supports PIN brute-forcing, allowing attackers to change Wi-Fi settings, PIN, port forward, and expose internal ports. Device uses custom Python code "rodman" for interaction, generating uuid4-based session identifier. APIs also use user's PIN as security code, enabling interaction with attacker's website and credential brute-forcing. Device's server sets Access-Control-Allow-Origin header to "*", making JSON payload interaction and sensitive information theft possible