POC-CVE-2017-8464-OpenCalculator

CVE-2017-8464 / 研究 + PoC 创建 1 个快捷方式 + 1 个包含恶意 payload 的 .DLL = 放入 USB 发送给受害者 = 受害者打开 USB = Payload 自动触发！ 根本原因 1. 首先我们需要弄清楚这个漏洞究竟出在哪里！它源于名为 Plug-and-Play（即插即用） 的功能，操作系统会自动检测设备、分配资源并加载合适的驱动程序，使其无需重启电脑即可立即工作。当你插入 USB 并用 Windows Explorer explorer.exe 打开文件夹时，操作系统会扫描文件，以便向用户显示相应的图标图像！ 2. 从旧版 Windows...

Astra Linux – Vulnerability in wpa, pupnp-1.8

The Open Connectivity Foundation’s UPnP specification prior to April 17, 2020, does not prohibit the acceptance of a subscription request with a delivery URL located in a different network segment than the fully qualified event-subscription URL. This is known as the “CallStranger” issue...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: PNP: Fixed a name memory leak in pnpallocdev. After committing change 1fa5ae857bb1 “Driver core: get rid of struct device’s busid string array”, the name of the device is allocated dynamically. devsetname was moved after pnpaddid...

DD-WRT Stack-Based Buffer Overflow Vulnerability

DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability...

CVE-2021-27137

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP which is off...

CVE-2021-27137

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP which is off...

CVE-2021-27137

CVE-2021-27137 affects DD-WRT’s UPnP service (ssdp.c) before change set 45724, where an unsafe strcpy copies user-supplied data into a fixed 128-byte buffer, enabling a remote unauthenticated attacker to overflow the buffer via M-SEARCH requests on UDP/1900. By default UPnP is off and bound to in...

CVE-2026-58547

Heap-based buffer overflow in Universal Plug and Play upnp.dll allows an authorized attacker to elevate privileges locally...

CVE-2026-50455

Use of uninitialized resource in Universal Plug and Play upnp.dll allows an authorized attacker to disclose information locally...

CVE-2026-49180

Improper link resolution before file access 'link following' in Universal Plug and Play upnp.dll allows an authorized attacker to disclose information locally...

CVE-2026-58547 Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability

...

CVE-2026-58547

CVE-2026-58547 is a Windows UPnP Device Host vulnerability. The issue is a heap-based buffer overflow in upnp.dll that allows an authenticated local attacker to elevate privileges. The NVD entry and multiple advisories describe the root cause as a heap overflow in UPnP device host, with CVSS deta...

CVE-2026-58547 Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability

...

CVE-2026-50455 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

...

CVE-2026-50455 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

...

CVE-2026-50455

CVE-2026-50455 describes an information disclosure in Universal Plug and Play (upnp.dll) caused by the use of an uninitialized resource. The vulnerability allows an authorized local attacker to disclose information. The reported impact shows confidentiality impact (C) as High, with local access a...

CVE-2026-49180 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

...

CVE-2026-49180 Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

...

Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

Use of uninitialized resource in Universal Plug and Play upnp.dll allows an authorized attacker to disclose information locally...

Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability

Improper link resolution before file access 'link following' in Universal Plug and Play upnp.dll allows an authorized attacker to disclose information locally...