CVE-2025-47976 Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability

...

Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability

Access of resource using incompatible type 'type confusion' in Windows SSDP Service allows an authorized attacker to elevate privileges locally...

Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability

Double free in Windows SSDP Service allows an authorized attacker to elevate privileges locally...

Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability

Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally...

PT-2025-28512 · Microsoft · Windows Ssdp Service +1

Name of the Vulnerable Software and Affected Versions: Windows SSDP Service affected versions not specified Description: The issue concerns a double free in the Windows SSDP Service, which allows an authorized attacker to elevate privileges locally. This means an attacker with certain permissions...

PT-2025-28546

Name of the Vulnerable Software and Affected Versions: Windows SSDP Service affected versions not specified Description: The issue is related to a 'type confusion' problem in the Windows SSDP Service, allowing an authorized attacker to elevate privileges locally. There is no information provided...

PT-2025-28513 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a use after free condition in the Windows SSDP Service, which allows an authorized attacker to elevate privileges locally. This means an attacker with certain...

PT-2025-28663 · D Link · D-Link Dir-645

Name of the Vulnerable Software and Affected Versions: D-Link DIR-645 versions 1.05B01 and earlier Description: A critical issue affects the ssdpcgi main function of the ssdpcgi component, located in the /htdocs/cgibin file. This problem leads to command injection and can be exploited remotely. T...

CVE-2021-29379

An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play UPnP is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target ST field of the SSDP M-SEARCH discover packet. NOTE: This vulnerability on...

CVE-2019-14363

A stack-based buffer overflow in the upnpd binary running on NETGEAR WNDR3400v3 routers with firmware version 1.0.1.181.0.63 allows an attacker to remotely execute arbitrary code via a crafted UPnP SSDP packet...

CVE-2019-14323

SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server, but only when strict stack checking is enabled. This is caused by an off-by-one error in ssdprecv in ssdpd.c...

OPENSUSE-SU-2024:11406-1 ssdp-responder-1.7-1.7 on GA media

These are all security issues fixed in the ssdp-responder-1.7-1.7 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2017-5042

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent...

SUSE CVE-2019-14323

SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server, but only when strict stack checking is enabled. This is caused by an off-by-one error in ssdprecv in ssdpd.c...

SUSE CVE-2020-13848

Portable UPnP SDK aka libupnp 1.12.1 and earlier allows remote attackers to cause a denial of service crash via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/servicetable/servicetable.c...

Security update for minidlna (moderate)

openSUSE Security Update: Security update for minidlna Announcement ID: openSUSE-SU-2022:0079-1 Rating: moderate References: 1181400 1196814 Cross-References: CVE-2022-26505 CVSS scores: CVE-2022-26505 SUSE: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports...

OPENSUSE-SU-2022:0079-1 Security update for minidlna

This update for minidlna fixes the following issues: minidlna was updated to version 1.3.1 boo1196814 - Fixed a potential crash in SSDP request parsing. - Fixed a configure script failure on some platforms. - Protect against DNS rebinding attacks. CVE-2022-26505 - Fix an socket leakage issue on...

CVE-2021-35393

Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or miniupnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due ...

CVE-2021-35392

Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or miniupnpd and is the successor to miniigd. The server is vulnerable to a heap buffer overflow that is present due to unsafe...

Stack overflow

Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or miniupnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due ...