Cybercriminals Now Using Plex Media Servers to Amplify DDoS Attacks

A new distributed denial-of-service attack DDoS vector has ensnared Plex Media Server systems to amplify malicious traffic against targets to take them offline. "Plex's startup processes unintentionally expose a Plex UPnP-enabled service registration responder to the general Internet, where it ca...

USN-4722-1: ReadyMedia (MiniDLNA) vulnerabilities

It was discovered that ReadyMedia MiniDLNA allowed subscription requests with a delivery URL on a different network segment than the fully qualified event- subscription URL. An attacker could use this to hijack smart devices and cause denial of service attacks. CVE-2020-12695 It was discovered th...

CVE-2020-18568

The D-Link DSR-250 3.14 DSR-1000N 2.11B201 UPnP service contains a command injection vulnerability, which can cause remote command execution...

Command injection

The D-Link DSR-250 3.14 DSR-1000N 2.11B201 UPnP service contains a command injection vulnerability, which can cause remote command execution...

CVE-2020-18568

The D-Link DSR-250 3.14 DSR-1000N 2.11B201 UPnP service contains a command injection vulnerability, which can cause remote command execution...

CVE-2020-18568

CVE-2020-18568 concerns a command injection vulnerability in the UPnP service of D-Link DSR-250 (3.14) and DSR-1000N (2.11B201). Multiple connected sources confirm an input-validation/command execution flaw in the UPnP component that could allow remote execution of arbitrary commands. Affected pr...

JVN#47580234: Multiple vulnerabilities in multiple ELECOM products

Multiple products provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below. Improper Access Control CWE-284 - CVE-2021-20643 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N| Base Score: 5.3 CVSS v2| AV:N/AC:L/Au:N/C:N/I:P/A:N| Base Score:...

Loxone Miniserver Detection Consolidation

Consolidation of Loxone Miniserver device detections. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; if descripti...

EulerOS 2.0 SP3 : wpa_supplicant (EulerOS-SA-2021-1131)

According to the version of the wpasupplicant package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a deliver...

Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the Universal Plug and Play UPnP service and the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow a remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly. For more...

CVE-2021-23242

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI...

CVE-2021-23242

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI...

Directory traversal

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI...

CVE-2021-23242

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI...

CVE-2021-23242

MERCUSYS Mercury X18G 1.0.5 devices are affected by CVE-2021-23242 due to a directory traversal vulnerability in the UPnP server, exploitable via path segments like ../ to access files (demonstrated by the /../../conf/template/uhttpd.json URI). The exposed detail across multiple sources confirms ...

CVE-2021-23242

MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd.json URI...

Directory Traversal Vulnerability in Phantom Route X18G Upnp Server

Phantom Router X18G is a router from Shenzhen Meike Star Communication Technology Co. A directory traversal vulnerability exists in the Mirage Router X18G Upnp Server, which can be exploited by an attacker to obtain sensitive information...

Updated minidlna packages fix security vulnerabilities

It was discovered that minidlna does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue CVE-2020-12695. Minidlna before versions 1.3.0 allows remote code execution...

UPnP With a Holiday Cheer

T'was the night before HaXmas, when all through the house, Not a creature was stirring, not even a mouse. The stockings were hung by the chimney with care, in hopes that St. Nicholas soon would be there. This may be the way you start your holiday cheer, but before you get started, let me make you...

Debian DLA-2489-1 : minidlna security update

It was discovered that missing input validation in minidlna, a lightweight DLNA/UPnP-AV server could result in the execution of arbitrary code. In addition minidlna was susceptible to the 'CallStranger' UPnP vulnerability. For Debian 9 stretch, these problems have been fixed in version...