Lucene search

[email protected]CVE-2020-12695

HistoryJun 08, 2020 - 5:15 p.m.

CVE-2020-12695

2020-06-0817:15:09

CWE-276

[email protected]

web.nvd.nist.gov

485

open connectivity foundation

upnp

cve-2020-12695

callstranger

network security

vulnerability

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:P/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H

AI Score

7.6

Confidence

High

EPSS

0.005

Percentile

77.5%

JSON

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

Affected configurations

NVD

Node

uiunifi_controllerMatch-

Node

w1.fihostapdRange<2.0.0

Node

asusrt-n11Match-

Node

broadcomadslMatch-

Node

canonselphy_cp1200Match-

Node

ciscowap131Match-

ciscowap150Match-

ciscowap351Match-

Node

dlinkdvg-n5412spMatch-

Node

dellb1165nfwMatch-

Node

epsonep-101Match-

epsonew-m970a3tMatch-

epsonm571tMatch-

epsonxp-100Match-

epsonxp-2101Match-

epsonxp-2105Match-

epsonxp-241Match-

epsonxp-320Match-

epsonxp-330Match-

epsonxp-340Match-

epsonxp-4100Match-

epsonxp-4105Match-

epsonxp-440Match-

epsonxp-620Match-

epsonxp-630Match-

epsonxp-702Match-

epsonxp-8500Match-

epsonxp-8600Match-

epsonxp-960Match-

epsonxp-970Match-

Node

hp5020_z4a69aMatch-

hp5030_m2u92bMatch-

hp5030_z4a70aMatch-

hp5034_z4a74aMatch-

hp5660_f8b04aMatch-

hpdeskjet_ink_advantage_3456_a9t84cMatch-

hpdeskjet_ink_advantage_3545_a9t81aMatch-

hpdeskjet_ink_advantage_3545_a9t81cMatch-

hpdeskjet_ink_advantage_3545_a9t83bMatch-

hpdeskjet_ink_advantage_3546_a9t82aMatch-

hpdeskjet_ink_advantage_3548_a9t81bMatch-

hpdeskjet_ink_advantage_4515Match-

hpdeskjet_ink_advantage_4518Match-

hpdeskjet_ink_advantage_4535_f0v64aMatch-

hpdeskjet_ink_advantage_4535_f0v64bMatch-

hpdeskjet_ink_advantage_4535_f0v64cMatch-

hpdeskjet_ink_advantage_4536_f0v65aMatch-

hpdeskjet_ink_advantage_4538_f0v66bMatch-

hpdeskjet_ink_advantage_4675_f1h97aMatch-

hpdeskjet_ink_advantage_4675_f1h97bMatch-

hpdeskjet_ink_advantage_4675_f1h97cMatch-

hpdeskjet_ink_advantage_4676_f1h98aMatch-

hpdeskjet_ink_advantage_4678_f1h99bMatch-

hpdeskjet_ink_advantage_5575_g0v48bMatch-

hpdeskjet_ink_advantage_5575_g0v48cMatch-

hpenvy_100_cn517aMatch-

hpenvy_100_cn517bMatch-

hpenvy_100_cn517cMatch-

hpenvy_100_cn518aMatch-

hpenvy_100_cn519aMatch-

hpenvy_100_cn519bMatch-

hpenvy_110_cq809aMatch-

hpenvy_110_cq809bMatch-

hpenvy_110_cq809cMatch-

hpenvy_110_cq809dMatch-

hpenvy_110_cq812cMatch-

hpenvy_111_cq810aMatch-

hpenvy_114_cq811aMatch-

hpenvy_114_cq811bMatch-

hpenvy_114_cq812aMatch-

hpenvy_120_cz022aMatch-

hpenvy_120_cz022bMatch-

hpenvy_120_cz022cMatch-

hpenvy_4500_a9t80aMatch-

hpenvy_4500_a9t80bMatch-

hpenvy_4500_a9t89aMatch-

hpenvy_4500_d3p93aMatch-

hpenvy_4501_c8d05aMatch-

hpenvy_4502_a9t85aMatch-

hpenvy_4502_a9t87bMatch-

hpenvy_4503_e6g71bMatch-

hpenvy_4504_a9t88bMatch-

hpenvy_4504_c8d04aMatch-

hpenvy_4505_a9t86aMatch-

hpenvy_4507_e6g70bMatch-

hpenvy_4508_e6g72bMatch-

hpenvy_4509_d3p94aMatch-

hpenvy_4509_d3p94bMatch-

hpenvy_4511_k9h50aMatch-

hpenvy_4512_k9h49aMatch-

hpenvy_4513_k9h51aMatch-

hpenvy_4516_k9h52aMatch-

hpenvy_4520_e6g67aMatch-

hpenvy_4520_e6g67bMatch-

hpenvy_4520_f0v63aMatch-

hpenvy_4520_f0v63bMatch-

hpenvy_4520_f0v69aMatch-

hpenvy_4521_k9t10bMatch-

hpenvy_4522_f0v67aMatch-

hpenvy_4523_j6u60bMatch-

hpenvy_4524_f0v71bMatch-

hpenvy_4524_f0v72bMatch-

hpenvy_4524_k9t01aMatch-

hpenvy_4525_k9t09bMatch-

hpenvy_4526_k9t05bMatch-

hpenvy_4527_j6u61bMatch-

hpenvy_4528_k9t08bMatch-

hpenvy_5000_m2u85aMatch-

hpenvy_5000_m2u85bMatch-

hpenvy_5000_m2u91a

hpenvy_5000_m2u91aMatch-

hpenvy_5000_m2u94bMatch-

hpenvy_5000_z4a54aMatch-

hpenvy_5000_z4a74aMatch-

hpenvy_5020_m2u91bMatch-

hpenvy_5530Match-

hpenvy_5531Match-

hpenvy_5532Match-

hpenvy_5534Match-

hpenvy_5535Match-

hpenvy_5536Match-

hpenvy_5539Match-

hpenvy_5540_f2e72aMatch-

hpenvy_5540_g0v47aMatch-

hpenvy_5540_g0v51aMatch-

hpenvy_5540_g0v52aMatch-

hpenvy_5540_g0v53aMatch-

hpenvy_5540_k7c85aMatch-

hpenvy_5541_k7g89aMatch-

hpenvy_5542_k7c88aMatch-

hpenvy_5543_n9u88aMatch-

hpenvy_5544_k7c89aMatch-

hpenvy_5544_k7c93aMatch-

hpenvy_5545_g0v50aMatch-

hpenvy_5546_k7c90aMatch-

hpenvy_5547_j6u64aMatch-

hpenvy_5548_k7g87aMatch-

hpenvy_5640_b9s56aMatch-

hpenvy_5640_b9s58aMatch-

hpenvy_5642_b9s64aMatch-

hpenvy_5643_b9s63aMatch-

hpenvy_5644_b9s65aMatch-

hpenvy_5646_f8b05aMatch-

hpenvy_5664_f8b08aMatch-

hpenvy_5665_f8b06aMatch-

hpenvy_6020_5se16bMatch-

hpenvy_6020_5se17aMatch-

hpenvy_6020_6wd35aMatch-

hpenvy_6020_7cz37aMatch-

hpenvy_6052_5se18aMatch-

hpenvy_6055_5se16aMatch-

hpenvy_6540_b9s59aMatch-

hpenvy_7640Match-

hpenvy_7644_e4w46aMatch-

hpenvy_7645_e4w44aMatch-

hpenvy_photo_6200_k7g18aMatch-

hpenvy_photo_6200_k7g26bMatch-

hpenvy_photo_6200_k7s21bMatch-

hpenvy_photo_6200_y0k13d_Match-

hpenvy_photo_6200_y0k15aMatch-

hpenvy_photo_6220_k7g20dMatch-

hpenvy_photo_6220_k7g21bMatch-

hpenvy_photo_6222_y0k13dMatch-

hpenvy_photo_6222_y0k14dMatch-

hpenvy_photo_6230_k7g25bMatch-

hpenvy_photo_6232_k7g26bMatch-

hpenvy_photo_6234_k7s21bMatch-

hpenvy_photo_6252_k7g22aMatch-

hpenvy_photo_7100_3xd89aMatch-

hpenvy_photo_7100_k7g93aMatch-

hpenvy_photo_7100_k7g99aMatch-

hpenvy_photo_7100_z3m37aMatch-

hpenvy_photo_7100_z3m52aMatch-

hpenvy_photo_7120_z3m41dMatch-

hpenvy_photo_7155_z3m52aMatch-

hpenvy_photo_7164_k7g99aMatch-

hpenvy_photo_7800_k7r96aMatch-

hpenvy_photo_7800_k7s00aMatch-

hpenvy_photo_7800_k7s10dMatch-

hpenvy_photo_7800_y0g42dMatch-

hpenvy_photo_7800_y0g52bMatch-

hpenvy_photo_7822_y0g42dMatch-

hpenvy_photo_7822_y0g43dMatch-

hpenvy_photo_7830_y0g50bMatch-

hpenvy_pro_6420_5se45bMatch-

hpenvy_pro_6420_5se46aMatch-

hpenvy_pro_6420_6wd14aMatch-

hpenvy_pro_6420_6wd16aMatch-

hpenvy_pro_6452_5se47aMatch-

hpenvy_pro_6455_5se45aMatch-

hpofficejet_4650_e6g87aMatch-

hpofficejet_4650_f1h96aMatch-

hpofficejet_4650_f1h96bMatch-

hpofficejet_4652_f1j02aMatch-

hpofficejet_4652_f1j05bMatch-

hpofficejet_4652_k9v84bMatch-

hpofficejet_4654_f1j06bMatch-

hpofficejet_4654_f1j07bMatch-

hpofficejet_4655_f1j00aMatch-

hpofficejet_4655_k9v79aMatch-

hpofficejet_4655_k9v82bMatch-

hpofficejet_4656_k9v81bMatch-

hpofficejet_4657_v6d29bMatch-

hpofficejet_4658_v6d30bMatch-

Node

huaweihg255sMatch-

huaweihg532eMatch-

Node

necwr8165nMatch-

Node

netgearwnhde111Match-

Node

ruckussecurityzonedirector_1200Match-

Node

tp-linkarcher_c50Match-

Node

ztezxv10_w300Match-

Node

zyxelamg1202-t10bMatch-

zyxelvmg8324-b10aMatch-

Node

microsoftwindows_10Match-

microsoftxbox_oneMatch10.0.19041.2494

Node

fedoraprojectfedoraMatch31

fedoraprojectfedoraMatch32

Node

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

Node

canonicalubuntu_linuxMatch20.04lts

VendorProductVersionCPE
uiunifi_controller-cpe:/a:ui:unifi_controller:-:::

Vendor	Product	Version	CPE
ui	unifi_controller	-	cpe:/a:ui:unifi_controller:-:::

References

packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html

www.openwall.com/lists/oss-security/2020/06/08/2

corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek/

github.com/corelight/callstranger-detector

github.com/yunuscadirci/CallStranger

lists.debian.org/debian-lts-announce/2020/08/msg00011.html

lists.debian.org/debian-lts-announce/2020/08/msg00013.html

lists.debian.org/debian-lts-announce/2020/12/msg00017.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3SHL4LOFGHJ3DIXSUIQELGVBDJ7V7LB/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZDWHKGN3LMGSUEOAAVAMOD3IUIPJVOJ/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQEYVY4D7LASH6AI4WK3IK2QBFHHF3Q2/

usn.ubuntu.com/4494-1/

www.callstranger.com

www.debian.org/security/2020/dsa-4806

www.debian.org/security/2021/dsa-4898

www.kb.cert.org/vuls/id/339275

www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of

Social References

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:P/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H

AI Score

7.6

Confidence

High

EPSS

0.005

Percentile

77.5%

JSON

CVE-2020-12695

Affected configurations

References

Social References

Related