CVE-2020-12695

🗓️ 08 Jun 2020 16:45:04Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 572 Views🌐 WEB

The Open Connectivity Foundation UPnP specification before 2020-04-17 allows subscription requests with a different network segment for delivery URL

Reporter	Title	Published	Views	Family All 146
Gitee	Exploit for Incorrect Default Permissions in Ui Unifi_Controller	8 Aug 202022:04	–	gitee
Gitee	Exploit for Incorrect Default Permissions in Ui Unifi_Controller	9 Aug 202015:05	–	gitee
Gitee	Exploit for Incorrect Default Permissions in Ui Unifi_Controller	6 Jul 202502:28	–	gitee
ATTACKERKB	CVE-2020-12695 "CallStranger"	8 Jun 202000:00	–	attackerkb
Tenable Nessus	AlmaLinux 8 : gssdp and gupnp (ALSA-2021:1789)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : gssdp and gupnp (CESA-2021:1789)	19 May 202100:00	–	nessus
Tenable Nessus	Debian DLA-2315-1 : gupnp security update	7 Aug 202000:00	–	nessus
Tenable Nessus	Debian DLA-2318-1 : wpa security update	10 Aug 202000:00	–	nessus
Tenable Nessus	Debian DLA-2489-1 : minidlna security update	11 Dec 202000:00	–	nessus
Tenable Nessus	Debian DSA-4806-1 : minidlna - security update	8 Dec 202000:00	–	nessus

NVD

Node

ui unifi_controllerMatch-

Node

w1.fi hostapdRange<2.0.0

Node

asus rt-n11Match-

Node

broadcom adslMatch-

Node

canon selphy_cp1200Match-

Node

cisco wap131Match-

cisco wap150Match-

cisco wap351Match-

Node

dlink dvg-n5412spMatch-

Node

dell b1165nfwMatch-

Node

epson ep-101Match-

epson ew-m970a3tMatch-

epson m571tMatch-

epson xp-100Match-

epson xp-2101Match-

epson xp-2105Match-

epson xp-241Match-

epson xp-320Match-

epson xp-330Match-

epson xp-340Match-

epson xp-4100Match-

epson xp-4105Match-

epson xp-440Match-

epson xp-620Match-

epson xp-630Match-

epson xp-702Match-

epson xp-8500Match-

epson xp-8600Match-

epson xp-960Match-

epson xp-970Match-

Node

hp 5020_z4a69aMatch-

hp 5030_m2u92bMatch-

hp 5030_z4a70aMatch-

hp 5034_z4a74aMatch-

hp 5660_f8b04aMatch-

hp deskjet_ink_advantage_3456_a9t84cMatch-

hp deskjet_ink_advantage_3545_a9t81aMatch-

hp deskjet_ink_advantage_3545_a9t81cMatch-

hp deskjet_ink_advantage_3545_a9t83bMatch-

hp deskjet_ink_advantage_3546_a9t82aMatch-

hp deskjet_ink_advantage_3548_a9t81bMatch-

hp deskjet_ink_advantage_4515Match-

hp deskjet_ink_advantage_4518Match-

hp deskjet_ink_advantage_4535_f0v64aMatch-

hp deskjet_ink_advantage_4535_f0v64bMatch-

hp deskjet_ink_advantage_4535_f0v64cMatch-

hp deskjet_ink_advantage_4536_f0v65aMatch-

hp deskjet_ink_advantage_4538_f0v66bMatch-

hp deskjet_ink_advantage_4675_f1h97aMatch-

hp deskjet_ink_advantage_4675_f1h97bMatch-

hp deskjet_ink_advantage_4675_f1h97cMatch-

hp deskjet_ink_advantage_4676_f1h98aMatch-

hp deskjet_ink_advantage_4678_f1h99bMatch-

hp deskjet_ink_advantage_5575_g0v48bMatch-

hp deskjet_ink_advantage_5575_g0v48cMatch-

hp envy_100_cn517aMatch-

hp envy_100_cn517bMatch-

hp envy_100_cn517cMatch-

hp envy_100_cn518aMatch-

hp envy_100_cn519aMatch-

hp envy_100_cn519bMatch-

hp envy_110_cq809aMatch-

hp envy_110_cq809bMatch-

hp envy_110_cq809cMatch-

hp envy_110_cq809dMatch-

hp envy_110_cq812cMatch-

hp envy_111_cq810aMatch-

hp envy_114_cq811aMatch-

hp envy_114_cq811bMatch-

hp envy_114_cq812aMatch-

hp envy_120_cz022aMatch-

hp envy_120_cz022bMatch-

hp envy_120_cz022cMatch-

hp envy_4500_a9t80aMatch-

hp envy_4500_a9t80bMatch-

hp envy_4500_a9t89aMatch-

hp envy_4500_d3p93aMatch-

hp envy_4501_c8d05aMatch-

hp envy_4502_a9t85aMatch-

hp envy_4502_a9t87bMatch-

hp envy_4503_e6g71bMatch-

hp envy_4504_a9t88bMatch-

hp envy_4504_c8d04aMatch-

hp envy_4505_a9t86aMatch-

hp envy_4507_e6g70bMatch-

hp envy_4508_e6g72bMatch-

hp envy_4509_d3p94aMatch-

hp envy_4509_d3p94bMatch-

hp envy_4511_k9h50aMatch-

hp envy_4512_k9h49aMatch-

hp envy_4513_k9h51aMatch-

hp envy_4516_k9h52aMatch-

hp envy_4520_e6g67aMatch-

hp envy_4520_e6g67bMatch-

hp envy_4520_f0v63aMatch-

hp envy_4520_f0v63bMatch-

hp envy_4520_f0v69aMatch-

hp envy_4521_k9t10bMatch-

hp envy_4522_f0v67aMatch-

hp envy_4523_j6u60bMatch-

hp envy_4524_f0v71bMatch-

hp envy_4524_f0v72bMatch-

hp envy_4524_k9t01aMatch-

hp envy_4525_k9t09bMatch-

hp envy_4526_k9t05bMatch-

hp envy_4527_j6u61bMatch-

hp envy_4528_k9t08bMatch-

hp envy_5000_m2u85aMatch-

hp envy_5000_m2u85bMatch-

hp envy_5000_m2u91a

hp envy_5000_m2u91aMatch-

hp envy_5000_m2u94bMatch-

hp envy_5000_z4a54aMatch-

hp envy_5000_z4a74aMatch-

hp envy_5020_m2u91bMatch-

hp envy_5530Match-

hp envy_5531Match-

hp envy_5532Match-

hp envy_5534Match-

hp envy_5535Match-

hp envy_5536Match-

hp envy_5539Match-

hp envy_5540_f2e72aMatch-

hp envy_5540_g0v47aMatch-

hp envy_5540_g0v51aMatch-

hp envy_5540_g0v52aMatch-

hp envy_5540_g0v53aMatch-

hp envy_5540_k7c85aMatch-

hp envy_5541_k7g89aMatch-

hp envy_5542_k7c88aMatch-

hp envy_5543_n9u88aMatch-

hp envy_5544_k7c89aMatch-

hp envy_5544_k7c93aMatch-

hp envy_5545_g0v50aMatch-

hp envy_5546_k7c90aMatch-

hp envy_5547_j6u64aMatch-

hp envy_5548_k7g87aMatch-

hp envy_5640_b9s56aMatch-

hp envy_5640_b9s58aMatch-

hp envy_5642_b9s64aMatch-

hp envy_5643_b9s63aMatch-

hp envy_5644_b9s65aMatch-

hp envy_5646_f8b05aMatch-

hp envy_5664_f8b08aMatch-

hp envy_5665_f8b06aMatch-

hp envy_6020_5se16bMatch-

hp envy_6020_5se17aMatch-

hp envy_6020_6wd35aMatch-

hp envy_6020_7cz37aMatch-

hp envy_6052_5se18aMatch-

hp envy_6055_5se16aMatch-

hp envy_6540_b9s59aMatch-

hp envy_7640Match-

hp envy_7644_e4w46aMatch-

hp envy_7645_e4w44aMatch-

hp envy_photo_6200_k7g18aMatch-

hp envy_photo_6200_k7g26bMatch-

hp envy_photo_6200_k7s21bMatch-

hp envy_photo_6200_y0k13d_Match-

hp envy_photo_6200_y0k15aMatch-

hp envy_photo_6220_k7g20dMatch-

hp envy_photo_6220_k7g21bMatch-

hp envy_photo_6222_y0k13dMatch-

hp envy_photo_6222_y0k14dMatch-

hp envy_photo_6230_k7g25bMatch-

hp envy_photo_6232_k7g26bMatch-

hp envy_photo_6234_k7s21bMatch-

hp envy_photo_6252_k7g22aMatch-

hp envy_photo_7100_3xd89aMatch-

hp envy_photo_7100_k7g93aMatch-

hp envy_photo_7100_k7g99aMatch-

hp envy_photo_7100_z3m37aMatch-

hp envy_photo_7100_z3m52aMatch-

hp envy_photo_7120_z3m41dMatch-

hp envy_photo_7155_z3m52aMatch-

hp envy_photo_7164_k7g99aMatch-

hp envy_photo_7800_k7r96aMatch-

hp envy_photo_7800_k7s00aMatch-

hp envy_photo_7800_k7s10dMatch-

hp envy_photo_7800_y0g42dMatch-

hp envy_photo_7800_y0g52bMatch-

hp envy_photo_7822_y0g42dMatch-

hp envy_photo_7822_y0g43dMatch-

hp envy_photo_7830_y0g50bMatch-

hp envy_pro_6420_5se45bMatch-

hp envy_pro_6420_5se46aMatch-

hp envy_pro_6420_6wd14aMatch-

hp envy_pro_6420_6wd16aMatch-

hp envy_pro_6452_5se47aMatch-

hp envy_pro_6455_5se45aMatch-

hp officejet_4650_e6g87aMatch-

hp officejet_4650_f1h96aMatch-

hp officejet_4650_f1h96bMatch-

hp officejet_4652_f1j02aMatch-

hp officejet_4652_f1j05bMatch-

hp officejet_4652_k9v84bMatch-

hp officejet_4654_f1j06bMatch-

hp officejet_4654_f1j07bMatch-

hp officejet_4655_f1j00aMatch-

hp officejet_4655_k9v79aMatch-

hp officejet_4655_k9v82bMatch-

hp officejet_4656_k9v81bMatch-

hp officejet_4657_v6d29bMatch-

hp officejet_4658_v6d30bMatch-

Node

huawei hg255sMatch-

huawei hg532eMatch-

Node

nec wr8165nMatch-

Node

netgear wnhde111Match-

Node

ruckussecurity zonedirector_1200Match-

Node

tp-link archer_c50Match-

Node

zte zxv10_w300Match-

Node

zyxel amg1202-t10bMatch-

zyxel vmg8324-b10aMatch-

Node

microsoft windows_10Match-

microsoft xbox_oneMatch10.0.19041.2494

Node

fedoraproject fedoraMatch31

fedoraproject fedoraMatch32

Node

debian debian_linuxMatch9.0

debian debian_linuxMatch10.0

Node

canonical ubuntu_linuxMatch20.04lts

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2020/08/msg00011.html
github	www.github.com/corelight/callstranger-detector
kb	www.kb.cert.org/vuls/id/339275
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3SHL4LOFGHJ3DIXSUIQELGVBDJ7V7LB/
tenable	www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of
packetstormsecurity	www.packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html
lists	www.lists.debian.org/debian-lts-announce/2020/08/msg00013.html
usn	www.usn.ubuntu.com/4494-1/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZDWHKGN3LMGSUEOAAVAMOD3IUIPJVOJ/
openwall	www.openwall.com/lists/oss-security/2020/06/08/2

Parameter	Position	Path	Description	CWE
Callback	header	//192.168.1.1:37215/evt/Layer3Forwarding_1	SUBSCRIBE callback header can be controlled to exploit CallStranger SSRF-like behavior on Layer3Forwarding service	CWE-276
Callback	header	//192.168.1.1:37215/evt/WANCommonInterfaceConfig_1	SUBSCRIBE callback header control on WANCommonInterfaceConfig service for CallStranger	CWE-276
Callback	header	//192.168.1.1:37215/evt/WANPPPConnection_1	SUBSCRIBE callback header control on WANPPPConnection service for CallStranger	CWE-276
Callback	header	//192.168.1.1:37215/evt/WANEthernetLinkConfig_1	SUBSCRIBE callback header control on WANEthernetLinkConfig service for CallStranger	CWE-276
Callback	header	//192.168.1.1:37215/evt/LANHostConfigManagement_1	SUBSCRIBE callback header control on LANHostConfigManagement service for CallStranger	CWE-276
Callback	header	//192.168.1.22:2870/event/RenderingControl	SUBSCRIBE callback header control on RenderingControl event for CallStranger	CWE-276
Callback	header	//192.168.1.22:2870/event/ConnectionManager	SUBSCRIBE callback header control on ConnectionManager event for CallStranger	CWE-276
Callback	header	//192.168.1.22:2870/event/AVTransport	SUBSCRIBE callback header control on AVTransport event for CallStranger	CWE-276
Callback	header	//192.168.1.40:2870/RenderingControl/event	SUBSCRIBE callback header control on RenderingControl event for CallStranger	CWE-276
Callback	header	//192.168.1.40:2870/ConnectionManager/event	SUBSCRIBE callback header control on ConnectionManager event for CallStranger	CWE-276

21 Nov 2024 05:00Current

7.6High risk

Vulners AI Score7.6

CVSS 3.17.5

CVSS 27.8

EPSS0.03982

CWE-276