CVE-2019-1405

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play UPnP service improperly allows COM object creation, aka ‘Windows UPnP Service Elevation of Privilege Vulnerability’. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker...

Microsoft Windows UPnP Service CVE-2019-1405 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Window...

KLA11871 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Support Update. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, execute arbitrary code, obtain sensitive information, bypass security restrictions. Below is a complete list of...

CVE-2019-16903

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead...

CVE-2019-16903

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead...

Directory traversal

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead...

CVE-2019-16903

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead...

CVE-2019-16903

Platinum UPnP SDK 1.2.0 contains a directory traversal flaw in Core/PltHttpServer.cpp due to checking for /.. instead of ../, enabling path traversal. Affected component: Platinum UPnP SDK 1.2.0 (PltHttpServer). Root cause: incorrect path normalization in the HTTP server. Impact is limited to vul...

15,000 webcams vulnerable to attack: how to protect against webcam hacking

Webcams may have been around for a long time, but that doesn’t mean we know what we’re doing with them. Webcam hacking has been around for equally as long, yet new research from Wizcase indicates that more than 15,000 private, web-connected cameras are exposed and readily accessible to the genera...

Finding a Better Route to Router and Home Network Security

When was the last time you looked at your home router? We tend to only notice these magical boxes when something goes wrong. And given that many of us get our router as part of a single broadband box technically known as a gateway, combining modem and router in one device, there’s even less...

AVM FRITZ!WLAN Repeater Detection (UPnP)

UPnP based detection of AVM FRITZ!WLAN Repeater devices. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NETGEAR WNDR3400v3 Stack Buffer Overflow Vulnerability

The NETGEAR WNDR3400v3 is a wireless router from NETGEAR. A buffer overflow vulnerability exists in the upnpd binary in the NETGEAR WNDR3400v3 using firmware version 1.0.1.181.0.63. The vulnerability originates when a network system or product performs an operation on memory without properly...

CVE-2019-14363

A stack-based buffer overflow in the upnpd binary running on NETGEAR WNDR3400v3 routers with firmware version 1.0.1.181.0.63 allows an attacker to remotely execute arbitrary code via a crafted UPnP SSDP packet...

Stack overflow

A stack-based buffer overflow in the upnpd binary running on NETGEAR WNDR3400v3 routers with firmware version 1.0.1.181.0.63 allows an attacker to remotely execute arbitrary code via a crafted UPnP SSDP packet...

CVE-2019-14363

CVE-2019-14363 affects NETGEAR WNDR3400v3 routers, where the upnpd binary is vulnerable to a stack-based buffer overflow in firmware 1.0.1.18_1.0.63. A crafted UPnP SSDP packet can cause remote code execution. The vulnerability is documented with high/critical severity (CVSS v3.0: 9.8, NETWORK, L...

CVE-2019-14363

A stack-based buffer overflow in the upnpd binary running on NETGEAR WNDR3400v3 routers with firmware version 1.0.1.181.0.63 allows an attacker to remotely execute arbitrary code via a crafted UPnP SSDP packet...

Vera Edge Home Controller Command Execution Vulnerability

Vera Edge Home Controller is a smart home central control unit. A security vulnerability exists in LuaUPnP in Vera Edge Home Controller version 1.7.4452. A remote attacker can exploit the vulnerability by sending the 'code' parameter to /port3480/datarequest to execute arbitrary operating system...

CVE-2017-8414

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter "-f"...

Memory corruption

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary orthrus in /sbin folder of the device handles all the UPnP connections received by the device. It seems that the binary performs a sprintf operation at address 0x0000A3E4 with the value in the command line parameter "-f"...

CVE-2017-8414

CVE-2017-8414 affects D-Link DCS-1100 and DCS-1130 network cameras. The /sbin orthrus UPnP handler takes the command-line parameter -f and performs a sprintf to the stack without length checking, which corrupts registers in a function (sub_A098) and leads to memory corruption. Public advisories (...