Vulnerability Note VU#357851

UPnP requests accepted over router WAN interfaces

Original Release date: 05 Oct 2011 | Last revised: 30 Nov 2012

Overview

Some Internet router devices incorrectly accept UPnP requests over the WAN interface.

Description

Universal Plug and Play (UPnP) is a networking protocol mostly used for personal computing devices to discover and communicate with each other and the Internet. Some UPnP enabled router devices incorrectly accept UPnP requests over the WAN interface. "AddPortMapping" and "DeletePortMapping" actions are accepted on these devices. These requests can be used to connect to internal hosts behind a NAT firewall and also proxy connections through the device and back out to the Internet. Additional details can be found in Daniel Garcia's whitepaper, "Universal plug and play (UPnP) mapping attacks". [PDF] A list of devices reported to be vulnerable can be found on the UPnP hacks website.

Impact

A remote unauthenticated attacker may be able to scan internal hosts or proxy Internet traffic through the device.

Solution

Contact the device's vendor to find out if a firmware update is available to address this vulnerability.

Workarounds

Disable UPnP on the device.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Canyon-TechAffected-05 Oct 2011
Edimax Computer CompanyAffected-05 Oct 2011
Linksys (A division of Cisco Systems)Affected-03 Oct 2011
SitecomAffected-05 Oct 2011
SweexAffected-05 Oct 2011
TechnicolorAffected-07 Oct 2011
ZyXELAffected-05 Oct 2011
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 9.4 AV:N/AC:L/Au:N/C:N/I:C/A:C
Temporal 8.0 E:POC/RL:W/RC:C
Environmental 8.0 CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Daniel Garcia for reporting this vulnerability.

This document was written by Jared Allar.

Other Information

  • CVE IDs: Unknown
  • Date Public: 05 Aug 2011
  • Date First Published: 05 Oct 2011
  • Date Last Updated: 30 Nov 2012
  • Severity Metric: 0.85
  • Document Revision: 16

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.