CVE-2017-13718

🗓️ 10 Jun 2019 21:31:30Reported by mitreType

The Starry Station (aka Starry Router) HTTP API supports PIN brute-forcing, allowing attackers to change Wi-Fi settings, PIN, port forward, and expose internal ports. Device uses custom Python code "rodman" for interaction, generating uuid4-based session identifier. APIs also use user's PIN as security code, enabling interaction with attacker's website and credential brute-forcing. Device's server sets Access-Control-Allow-Origin header to "*", making JSON payload interaction and sensitive information theft possible

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2017-13718	11 Jun 201902:31	–	circl
Cvelist	CVE-2017-13718	10 Jun 201921:31	–	cvelist
EUVD	EUVD-2017-5235	7 Oct 202500:30	–	euvd
NVD	CVE-2017-13718	10 Jun 201922:29	–	nvd
Prion	Code injection	10 Jun 201922:29	–	prion
Positive Technologies	PT-2019-7955	10 Jun 201900:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2017-13718: Undefined Security Weakness	10 Jun 201900:00	–	rapid7

NVD

Node

AND

starry s00111_firmwareMatch-

starry s00111Match-

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/153240/Starry-Router-Camera-PIN-Brute-Force-CORS-Incorrect.html
github	www.github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Starry_sec_issues.pdf
seclists	www.seclists.org/bugtraq/2019/Jun/8

17 Jun 2026 01:05Current

7.7High risk

Vulners AI Score7.7

CVSS 26

CVSS 38

EPSS0.02021

CWE-254