zmap

ZMap: The Internet Scanner ZMap is a fast stateless single packet network scanner designed for Internet-wide network surveys. On a typical desktop computer with a gigabit Ethernet connection, ZMap is capable of scanning the entire public IPv4 address space on a single port in under 45 minutes. Fo...

HikPwn

HikPwn HikPwn, a simple scanner for Hikvision devices with basic vulnerability scanning capabilities written in Python 3.8. This project was born out of curiosity while I was capturing and watching network traffic generated by some Hikvision's software and devices. Setup instructions: git clone...

HG532d-RCE-Exploit

HG532d RCE Exploit Overview A Remote Code Execution RCE exploit based on CVE-2017-17215 vulnerability. Modded from original PoC code from exploit-db.com to work on Huawei HG532d Home Gateway Routers. Description This RCE exploit is based on CVE-2017-17215 which exploits vulnerabilities in the UPn...

CVE-2021-34730

Cisco RV110W UPnP 0day Analysis Preface UPnP has been a hot topic recently. I happened to have a Cisco RV110W device on hand. In August 2021, Cisco officially disclosed a 0day regarding UPnP in the RV series, but the specific details were not published. So I wanted to debug and exploit this...

COMahawk

COMahawk Privilege Escalation: Weaponizing CVE-2019-1405 and CVE-2019-1322 Video Demo https://vimeo.com/373051209 Usage Compile or Download from Release https://github.com/apt69/COMahawk/releases 1. Run COMahawk.exe 2. ??? 3. Hopefully profit or 1. COMahawk.exe "custom command to run" ie...

evil-ssdp

Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...

evil-ssdp

Resumen Esta herramienta responde a solicitudes de descubrimiento multicast SSDP, haciéndose pasar por un dispositivo UPNP genérico. Tu dispositivo suplantado aparecerá mágicamente en el Explorador de Windows en las máquinas de tu red local. Los usuarios que sean tentados a abrir el dispositivo...

st

ST Smart Things ST Smart Things Sentinel es una herramienta de seguridad avanzada diseñada específicamente para examinar y detectar amenazas dentro de los intrincados protocolos utilizados por los dispositivos IoT Internet de las cosas. En el panorama en constante expansión de los dispositivos...

CVE-2023-46012

CVE-2023-46012 LINKSYS AC1900 EA7500v3 IGD UPnP Stack Buffer Overflow Remote Code Execution Vulnerability This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of LINKSYS EA7500 routers. Authentication is not required to exploit this vulnerabilit...

UPnPHostFileRead

Description Local arbitrary file read PoC exploit for the Windows UPnP Device Host service. Reads an arbitrary file in the context of LOCAL SERVICE. Tested against Windows 11 Pro build 26200.8457. Reported to Microsoft. Assessed as "not a vulnerability". How to Build 1. Clone the repository. 2...

callstranger-detector

Zeek Package that detects CallStranger CVE-2020-12695 attempts http://callstranger.com/ This package attempts to detect CallStranger CVE-2020-12695 exploitation attempts and data exfiltration. It does so by looking for three key things: 1. UPnP SUBSCRIBE commands with a Notify URL that contains a...

CVE-2025-45422---Bbox

CVE-2025-45422: Proximus b-box UPnP Persistence & Access Control Bypass https://vulners.com/cve/CVE-2025-45422 This script demonstrates CVE-2025-45422 affecting Proximus b-box routers running firmware version 8c.725A. It leverages the router’s UPnP functionality to create arbitrary port forwardin...

CallStranger

CallStranger This script created by Yunus Çadırcı https://twitter.com/yunuscadirci to check against CallStranger CVE-2020-12695 vulnerability. An attacker can use this vulnerability for: Bypassing DLP for exfiltrating data Using millions of Internet-facing UPnP device as source of amplified...

cve-2020-9373-netgear-r6400

CVE-2020-9373 — Netgear R6400 upnpd Stack Overflow Research A complete three-phase study of the historical Netgear R6400 router vulnerability CVE-2020-9373 UPnP upnpd stack buffer overflow, SSDP on UDP port 1900, unauthenticated RCE/DoS. Three Phases 1. Phase 1 · Reproduction : firmware unpacking...

[SECURITY] Fedora 45 Update: rygel-46.0-2.fc45

Rygel is a home media solution that allows you to easily share audio, video a nd pictures, and control of media player on your home network. In technical terms it is both a UPnP AV MediaServer and MediaRenderer implemented through a plug -in mechanism. Interoperability with other devices in the...

[SECURITY] Fedora 45 Update: dleyna-0.8.3-11.fc45

dLeyna is a set of services and D-Bus APIs that aim to simplify access to UPnP and DLNA media devices in a network...

UPnP-Pentest-Toolkit

UPnP Pentest Toolkit This tool aims to bring together a range of UPnP assessment features, enabling quick assessment with minimal configuration and set-up. It has been developed to aid security consultants in exploring, spoofing and manipulating of UPnP devices and the underlying protocols at wor...

NetAudit-IoT

UPnP-Exploit-Auditor Advanced Research Tool for libupnp Vulnerabilities This repository contains professional research and a reconnaissance tool focused on libupnp 1.6.19 memory corruption vulnerabilities specifically CVE-2012-5958. Key Features Version Fingerprinting: Detects vulnerable libupnp...

CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport

CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service DoS. Vendor: TCL Technology Group Corporation Product: TCL Smart ...

CVE-2025-55971-Blind-Unauthenticated-SSRF-in-TCL-Smart-TV-UPnP-DLNA-AVTransport

CVE-2025-55971-Blind-Unauthenticated-SSRF-in-TCL-Smart-TV-UPnP-DLNA-AVTransport TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 Android TV, Kernel 5.4.242+, is vulnerable to a blind, unauthenticated Server-Side Request Forgery SSRF via the UPnP MediaRenderer service...