cve-2020-9373-netgear-r6400

CVE-2020-9373 — Netgear R6400 upnpd Stack Overflow Research A complete three-phase study of the historical Netgear R6400 router vulnerability CVE-2020-9373 UPnP upnpd stack buffer overflow, SSDP on UDP port 1900, unauthenticated RCE/DoS. Three Phases 1. Phase 1 · Reproduction : firmware unpacking...

UPnP-Pentest-Toolkit

UPnP Pentest Toolkit This tool aims to bring together a range of UPnP assessment features, enabling quick assessment with minimal configuration and set-up. It has been developed to aid security consultants in exploring, spoofing and manipulating of UPnP devices and the underlying protocols at wor...

ufuzz

UFuzz, or Universal Plug and Fuzz, is an automatic UPnP fuzzing tool. It will enumerate all UPnP endpoints on the network, find the available services and fuzz them. It also has the capability to fuzz HTTP using Burp proxy logs. It is designed to fuzz embedded systems, and as such, is only single...

CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport

CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service DoS. Vendor: TCL Technology Group Corporation Product: TCL Smart ...

CVE-2025-55971-Blind-Unauthenticated-SSRF-in-TCL-Smart-TV-UPnP-DLNA-AVTransport

CVE-2025-55971-SSRF-Ciego-No-Autenticado-en-TCL-Smart-TV-UPnP-DLNA-AVTransport El Smart TV TCL 65C655, con la versión de firmware V8-R75PT01-LF1V269.001116 Android TV, Kernel 5.4.242+, es vulnerable a una Server-Side Request Forgery SSRF ciega y no autenticada a través del servicio UPnP...

NetAudit-IoT

UPnP-Exploit-Auditor Herramienta de investigación avanzada para vulnerabilidades de libupnp Este repositorio contiene investigación profesional y una herramienta de reconocimiento centrada en las vulnerabilidades de corrupción de memoria de libupnp 1.6.19 específicamente CVE-2012-5958...

CVE-2026-51677

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83825

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

EUVD-2026-68540

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51677

Incorrect access control in the setUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to change UPnP service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51677

TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the setUPnPCfg function, accessible via the /cgi-bin/cstecgi.cgi endpoint. An unauthenticated network attacker can send a crafted POST request to change the UPnP service state , achieving high confident...

EUVD-2026-67936

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. Successful exploitation may result in ...

EUVD-2026-67935

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly. Successful exploitation may result in a...

CVE-2026-76649

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly. Successful exploitation may result in a...

CVE-2026-76650

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. Successful exploitation may result in ...

CVE-2026-76650 Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. Successful exploitation may result in ...

CVE-2026-76650

CVE-2026-76650 is a NULL pointer dereference in the UPnP service of TP-Link TL-WR841N v14 , triggered by a specially crafted SOAP state variable query request . Successful exploitation causes the UPnP process to terminate or become unstable, resulting in a denial-of-service affecting UPnP discove...

CVE-2026-76649

TP-Link TL-WR841N v14 is affected by a pre-authentication NULL pointer dereference in its UPnP service when processing SOAP action requests. A specially crafted SOAP request containing unexpected XML content causes the UPnP daemon to terminate, resulting in a denial-of-service condition that pers...

CVE-2026-76649 Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841N

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly. Successful exploitation may result in a...

CVE-2026-51652

Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...