1769 matches found
CVE-2026-51652
Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-83354
A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. Successful exploitation may result in ...
CVE-2026-51652
Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51652
The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the getUPnPCfg function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Successful exploitation allows the attacker to o...
CVE-2026-76650: NULL Pointer Dereference
A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. Successful exploitation may result in ...
CVE-2026-76649: NULL Pointer Dereference
A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly. Successful exploitation may result in a...
EUVD-2026-67882
Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gupnp (UTSA-2026-093025)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093025 advisory. The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different...
CVE-2026-75501
Rejected reason: Vendor could not replicate the vul, and reporter is unavailable to comment...
EUVD-2026-63988
A vulnerability in the Calix EXOS firmware for the GS7 XGS GS5239XG residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without...
CVE-2026-75501
The Calix GS7 XGS (GS5239XG) residential router running EXOS firmware 6.6.47 exposes its MiniUPnPd WANIPConnection service on the public WAN interface at TCP port 5000 without authentication. Unauthenticated remote attackers can send crafted SOAP requests to add, delete, or enumerate NAT port map...
CVE-2026-75501
...
PT-2026-79389
Name of the Vulnerable Software and Affected Versions Calix EXOS firmware version 6.6.47 Description An issue in the Calix EXOS firmware for the GS7 XGS GS5239XG residential router allows unauthenticated remote attackers to modify NAT port-forwarding rules. The device exposes the MiniUPnPd contro...
Retraction of "Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability"
Overview The Calix GS7 XGS GS5239XG router running firmware EXOS/6.6.47 contains a missing authentication vulnerability that exposes its UPnP Universal Plug and Play WANIPConnection service on the public WAN interface After further analysis of the case alongside the Calix security team, we have...
The vulnerability of the UPnP microprogramming software for routers, DD-WRT, allows a hacker to trigger a service failure.
The vulnerability of the UPnP microprogramming software for routers with DD-WRT is related to buffer overflow in the stack. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted requests through the UDP port...
Exploit for CVE-2020-9373
CVE-2020-9373 – Netgear R6400 UPnP upnpd stack overflow vuln...
CVE-2021-27137: Stack-based Buffer Overflow
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP which is off...
EUVD-2021-34854
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP which is off...
CVE-2021-27137
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP which is off...