CVE-2021-33959

CVE-2021-33959 Plex 서비스가 32410, 32412, 32413 및 32414의 네 개의 udp 포트를 수신하는 것을 확인할 수 있습니다. 공격 페이로드 분석과 장치 쿼리 요청의 메시지 형식을 참고하여, M-SEARCH HTTP/1.1 공격 페이로드가 포함된 udp 패킷을 이 포트들로 전송하고 반사 소스 IP에 대한 패킷을 캡처하는 소프트웨어를 작성했습니다. 마지막으로 32410과 32414가 모두 응답하는 것을 발견했습니다. 재현 공격은 다음 그림과 같습니다. 요청 보내기 echo "M-SEARCH...

CVE-2012-5960-PoC

CVE-2012-5960-PoC CVE-2012-5960, CVE-2012-5959 Proof of Concept 최근에 가지고 논 것들을 간단히 기록해 둔다. !/usr/bin/python2 -- coding: utf-8 -- Usage: python2 libupnpDoSPoC.py import socket TARGET = 'TARGETIP' ''' normaltraffic = \ 'M-SEARCH HTTP/1.1\r\n' \ 'HOST:239.255.255.250:1900\r\n' \ 'MX:3\r\n' ...

CVE-2021-27137

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP which is off...

CVE-2021-27137

CVE-2021-27137 affects DD-WRT’s UPnP service (ssdp.c) before change set 45724, where an unsafe strcpy copies user-supplied data into a fixed 128-byte buffer, enabling a remote unauthenticated attacker to overflow the buffer via M-SEARCH requests on UDP/1900. By default UPnP is off and bound to in...

CVE-2021-47854

DD-WRT version 45723 contains a buffer overflow vulnerability in the UPNP network discovery service that allows remote attackers to potentially execute arbitrary code. Attackers can send crafted M-SEARCH packets with oversized UUID payloads to trigger buffer overflow conditions on the target devi...

CVE-2021-47854 DD-WRT 45723 - UPNP Buffer Overflow

DD-WRT version 45723 contains a buffer overflow vulnerability in the UPNP network discovery service that allows remote attackers to potentially execute arbitrary code. Attackers can send crafted M-SEARCH packets with oversized UUID payloads to trigger buffer overflow conditions on the target devi...

EUVD-2026-3629

DD-WRT version 45723 contains a buffer overflow vulnerability in the UPNP network discovery service that allows remote attackers to potentially execute arbitrary code. Attackers can send crafted M-SEARCH packets with oversized UUID payloads to trigger buffer overflow conditions on the target devi...

CVE-2021-47854

DD-WRT version 45723 contains a buffer overflow vulnerability in the UPNP network discovery service that allows remote attackers to potentially execute arbitrary code. Attackers can send crafted M-SEARCH packets with oversized UUID payloads to trigger buffer overflow conditions on the target devi...

CVE-2021-47854

CVE-2021-47854 affects DD-WRT 45723 and describes a buffer overflow in the UPNP network discovery service. The vulnerability is triggered by receiving crafted M-SEARCH packets with oversized UUID payloads, which can lead to remote code execution on the targeted device. The CVSS metrics indicate a...

PT-2026-3807

DD-WRT version 45723 contains a buffer overflow vulnerability in the UPNP network discovery service that allows remote attackers to potentially execute arbitrary code. Attackers can send crafted M-SEARCH packets with oversized UUID payloads to trigger buffer overflow conditions on the target devi...

CVE-2021-47854: Buffer Copy without Checking Size of Input

DD-WRT version 45723 contains a buffer overflow vulnerability in the UPNP network discovery service that allows remote attackers to potentially execute arbitrary code. Attackers can send crafted M-SEARCH packets with oversized UUID payloads to trigger buffer overflow conditions on the target devi...

EUVD-2019-10770

Malware in sbrugna...

EUVD-2019-10771

Malware in sbrugna...

EUVD-2024-54344

Malicious code in bioql PyPI...

The vulnerability of the ssdpcgi_main function in D-Link DIR-860L router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the ssdpcgimain function in D-Link DIR-860L router microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands b...

CVE-2021-29379

An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play UPnP is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target ST field of the SSDP M-SEARCH discover packet. NOTE: This vulnerability on...

CVE-2021-35392

Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or miniupnpd and is the successor to miniigd. The server is vulnerable to a heap buffer overflow that is present due to unsafe...

CVE-2024-54802

In Netgear WNR854T 1.5.2 North America, the UPNP service /usr/sbin/upnp is vulnerable to stack-based buffer overflow in the M-SEARCH Host header...

The vulnerability of the advertise_res() function in the UPnP service of Netgear’s WNR854T router allows a hacker to execute arbitrary code.

The vulnerability of the advertiseres function of the UPnP service involves an escape from the buffer boundaries in memory when processing the M-SEARCH request header value. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending specially crafted M-SEARCH...

CVE-2024-54802

In Netgear WNR854T 1.5.2 North America, the UPNP service /usr/sbin/upnp is vulnerable to stack-based buffer overflow in the M-SEARCH Host header...