The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gupnp-develUpgrade gssdp-docsUpgrade gssdpUpgrade gssdp-devel | May 4, 2022 | Jun 8, 2020 |
| Alpine Linux | — | Upgrade minidlnaUpgrade hostapd | Jul 9, 2020 | Jun 8, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 8, 2020 |
| Centos_linux | — | Upgrade gupnpUpgrade gssdp-debuginfoUpgrade gssdpUpgrade gupnp-debuginfoUpgrade gssdp-debugsourceUpgrade gssdp-utils-debuginfoUpgrade gupnp-debugsource | Jun 1, 2021 | Jun 8, 2020 |
| Debian | — | Upgrade minidlnaUpgrade gupnpUpgrade wpa | Aug 10, 2020 | Jun 8, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade wpa_supplicant | Feb 22, 2021 | Jun 8, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade wpa_supplicant | Jan 20, 2021 | Jun 8, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade wpa_supplicant | Nov 2, 2020 | Jun 8, 2020 |
| Oracle Solaris | — | Upgrade library/desktop/gupnp-igd to version 0.2.5-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/desktop/gssdp to version 1.0.5-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/desktop/gupnp to version 1.0.6-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Jun 8, 2020 |
| Oracle_linux | — | Upgrade gupnp-develUpgrade gssdpUpgrade gssdp-docsUpgrade gssdp-develUpgrade gupnp | May 26, 2021 | Jun 8, 2020 |
| Redhat_linux | — | Upgrade gupnp-debugsourceNo solution existsUpgrade gupnp-develUpgrade gssdp-debuginfoUpgrade gssdp-docsUpgrade gupnp-debuginfoUpgrade gssdp-develUpgrade gssdp-utils-debuginfoUpgrade gssdpUpgrade gssdp-debugsourceUpgrade gupnp | May 21, 2021 | Jun 8, 2020 |
| Rocky_linux | — | Upgrade gssdpUpgrade gssdp-develUpgrade gssdp-debuginfoUpgrade gssdp-debugsource | Mar 12, 2024 | Jun 8, 2020 |
| Suse | — | Upgrade hostapdUpgrade minidlna | Dec 11, 2020 | Jun 8, 2020 |
| Ubuntu | — | Upgrade hostapd (Ubuntu Pro)Upgrade minidlnaUpgrade libgupnp-1.2-0Upgrade hostapdUpgrade wpasupplicant (Ubuntu Pro)Upgrade wpasupplicant | Sep 16, 2020 | Jun 8, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub