CVE-2026-76649

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly. Successful exploitation may result in a...

CVE-2026-76650

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. Successful exploitation may result in ...

CVE-2026-76650

CVE-2026-76650 is a NULL pointer dereference in the UPnP service of TP-Link TL-WR841N v14 , triggered by a specially crafted SOAP state variable query request . Successful exploitation causes the UPnP process to terminate or become unstable, resulting in a denial-of-service affecting UPnP discove...

CVE-2026-76650 Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP state variable query requests. A specially crafted SOAP query may trigger unexpected termination or instability of the process hosting the UPnP service. Successful exploitation may result in ...

CVE-2026-76649

TP-Link TL-WR841N v14 is affected by a pre-authentication NULL pointer dereference in its UPnP service when processing SOAP action requests. A specially crafted SOAP request containing unexpected XML content causes the UPnP daemon to terminate, resulting in a denial-of-service condition that pers...

CVE-2026-76649 Pre-Authentication NULL Pointer Dereference in UPnP SOAP Action Request Processing in TP-Link TL-WR841N

A NULL pointer dereference vulnerability exists in TL-WR841N v14 in the UPnP service when processing SOAP action requests. A specially crafted SOAP action request containing unexpected XML content may cause the UPnP daemon to terminate unexpectedly. Successful exploitation may result in a...

CVE-2026-51652

Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

cve-2020-9373-netgear-r6400

CVE-2020-9373 — Ricerca sullo stack overflow di upnpd su Netgear R6400 Studio completo in tre fasi sulla vulnerabilità storica CVE-2020-9373 del router Netgear R6400 stack buffer overflow in upnpd UPnP, SSDP sulla porta UDP 1900, RCE/DoS senza autenticazione. Le tre fasi 1. Fase 1 · Riproduzione ...

CVE-2026-51652

Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51652

CVE-2026-51652 is an incorrect access control flaw in the getUPnPCfg function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015 ). An unauthenticated attacker on the adjacent network can send a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve UPnP enablement status and parsed port...

EUVD-2026-67882

Incorrect access control in the getUPnPCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gupnp (UTSA-2026-093025)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093025 advisory. The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different...

UPnP-Pentest-Toolkit

UPnP Pentest Toolkit Dieses Tool soll eine Reihe von UPnP-Bewertungsfunktionen bündeln und eine schnelle Bewertung mit minimaler Konfiguration und Einrichtung ermöglichen. Es wurde entwickelt, um Sicherheitsberater bei der Erkundung, dem Spoofing und der Manipulation von UPnP-Geräten und den...

CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport

CVE-2025-55972-Remote-Unauthenticated-Denial-of-Service-DoS-in-TCL-Smart-TV-UPnP-DLNA-AVTransport Una Smart TV TCL che esegue un'implementazione UPnP/DLNA MediaRenderer vulnerabile è affetta da un Denial of Service DoS remoto e non autenticato. Vendor: TCL Technology Group Corporation Prodotto:...

CVE-2025-55971-Blind-Unauthenticated-SSRF-in-TCL-Smart-TV-UPnP-DLNA-AVTransport

CVE-2025-55971-Blind-Unauthenticated-SSRF-in-TCL-Smart-TV-UPnP-DLNA-AVTransport La Smart TV TCL 65C655, con versione firmware V8-R75PT01-LF1V269.001116 Android TV, Kernel 5.4.242+, è vulnerabile a una Server-Side Request Forgery SSRF cieca e non autenticata tramite il servizio UPnP MediaRenderer...

ufuzz

UFuzz, oder Universal Plug and Fuzz, ist ein automatisches UPnP-Fuzzing-Tool. Es listet alle UPnP-Endpunkte im Netzwerk auf, findet die verfügbaren Dienste und fuzzt diese. Es besitzt außerdem die Fähigkeit, HTTP mithilfe von Burp-Proxy-Logs zu fuzzen. Es ist dafür ausgelegt, eingebettete Systeme...

NetAudit-IoT

UPnP-Exploit-Auditor Strumento di Ricerca Avanzato per Vulnerabilità libupnp Questo repository contiene ricerche professionali e uno strumento di ricognizione focalizzato sulle vulnerabilità di corruzione della memoria di libupnp 1.6.19 in particolare CVE-2012-5958. Caratteristiche Principali...

Astra Linux – Vulnerability in GUPNP

A vulnerability was discovered in GUPnP before versions 1.0.7, 1.1.x, and 1.2.x, as well as before version 1.2.5. This vulnerability allows for DNS rebinding. A remote web server can exploit this vulnerability to trick the victim’s browser into performing actions against local UPnP services...

CVE-2026-75501

A vulnerability in the Calix EXOS firmware for the GS7 XGS GS5239XG residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without...

CVE-2026-75501 CVE-2026-75501

A vulnerability in the Calix EXOS firmware for the GS7 XGS GS5239XG residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without...