CVE-2020-1354

CVE-2020-1354 affects the Windows UPnP Device Host; root cause is improper memory handling leading to Elevation of Privilege. Exploitation requires local execution on the victim system, with impact described as elevated privileges. This CVE is related to CVE-2020-1430 and appears in NVD and CVE r...

Windows UPnP Device Host Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows UPnP Device Host improperly handles memory. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The...

Windows UPnP Device Host Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows UPnP Device Host improperly handles memory. To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges. The...

KB4565540: Windows 8.1 and Windows Server 2012 R2 July 2020 Security Update

The remote Windows host is missing security update 4565540 or cumulative update 4565541. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory. An attacker who successfully exploited this...

KB4565535: Windows Server 2012 July 2020 Security Update

The remote Windows host is missing security update 4565535 or cumulative update 4565537. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory. An attacker who successfully exploited this...

KB4565539: Windows 7 and Windows Server 2008 R2 July 2020 Security Update

The remote Windows host is missing security update 4565539 or cumulative update 4565524. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory. An attacker who successfully exploited this...

KB4565529: Windows Server 2008 July 2020 Security Update

The remote Windows host is missing security update 4565529 or cumulative update 4565536. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory. An attacker who successfully exploited this...

[SECURITY] Fedora 31 Update: gupnp-1.0.5-1.fc31

GUPnP is an object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible...

[SECURITY] Fedora 31 Update: gssdp-1.0.4-1.fc31

GSSDP implements resource discovery and announcement over SSDP and is part of gUPnP. GUPnP is an object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible...

[SECURITY] Fedora 32 Update: gupnp-1.0.5-1.fc32

GUPnP is an object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible...

[SECURITY] Fedora 32 Update: gssdp-1.0.4-1.fc32

GSSDP implements resource discovery and announcement over SSDP and is part of gUPnP. GUPnP is an object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible...

Security Advisory - CallStranger Vulnerability in UPnP Protocol

There is an vulnerability in UPnP protocol that does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, named CallStranger. The UPnP function of Huawei product is enabled only on the LAN side and ...

NETGEAR R6700v3 Password Reset / Remote Code Execution Exploit

This document describes a stack overflow vulnerability that was found in October, 2019 and presented in the Pwn2Own Mobile 2019 competition in November 2019. The vulnerability is present in the UPNP daemon /usr/sbin/upnpd, running on NETGEAR R6700v3 router with firmware versions V1.0.4.8210.0.57...

NETGEAR R6700v3 Password Reset / Remote Code Execution

tokyodrift ======= Summary This document describes a stack overflow vulnerability that was found by Pedro Ribeiro @pedrib1337 | [email protected] and Radek Domanski @RabbitPro in October 2019 and presented in the Pwn2Own Mobile 2019 competition in November 2019. The vulnerability is present in the...

BSA-2020-1028

Security Advisory ID : BSA-2020-1028 Component : Call Stranger Revision : 1.0: Final A vulnerability in the UPnP SUBSCRIBE capability permits an attacker to send large amounts of data to arbitrary destinations accessible over the Internet, which could lead to a Distributed Denial of Service DDoS,...

(0Day) (Pwn2Own) NETGEAR R6700 UPnP SOAPAction Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000. A crafted UPnP message...

(0Day) (Pwn2Own) NETGEAR R6700 UPnP NewBlockSiteName Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the UPnP...

CVE-2020-12695

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. Mitigation To mitigate this flaw, close of...

CERT/CC Reports Vulnerability in Universal Plug and Play Protocol

The CERT Coordination Center CERT/CC has released information on a vulnerability—CVE-2020-12695—affecting versions of the Universal Plug and Play UPnP protocol released before April 17, 2020. UPnP protocol allows networked devices to discover and connect with each other. A remote attacker could...

CVE-2020-12695

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue...