The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gupnp-develUpgrade gssdp-docsUpgrade gssdp-develUpgrade gssdp | May 4, 2022 | Jun 8, 2020 |
| Alpine Linux | — | Upgrade minidlnaUpgrade hostapd | Jul 9, 2020 | Jun 8, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 8, 2020 |
| Centos_linux | — | Upgrade gupnp-debugsourceUpgrade gssdp-utils-debuginfoUpgrade gssdpUpgrade gssdp-debugsourceUpgrade gupnp-debuginfoUpgrade gssdp-debuginfoUpgrade gupnp | Jun 1, 2021 | Jun 8, 2020 |
| Debian | — | Upgrade minidlnaUpgrade gupnpUpgrade wpa | Aug 10, 2020 | Jun 8, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade wpa_supplicant | Feb 22, 2021 | Jun 8, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade wpa_supplicant | Jan 20, 2021 | Jun 8, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade wpa_supplicant | Nov 2, 2020 | Jun 8, 2020 |
| Oracle Solaris | — | Upgrade library/desktop/gssdp to version 1.0.5-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/desktop/gupnp to version 1.0.6-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/desktop/gupnp-igd to version 0.2.5-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Jun 8, 2020 |
| Oracle_linux | — | Upgrade gupnpUpgrade gssdp-develUpgrade gupnp-develUpgrade gssdp-docsUpgrade gssdp | May 26, 2021 | Jun 8, 2020 |
| Redhat_linux | — | Upgrade gssdp-debugsourceUpgrade gssdp-docsUpgrade gssdp-utils-debuginfoUpgrade gssdp-develUpgrade gupnpUpgrade gssdpUpgrade gupnp-debuginfoUpgrade gupnp-debugsourceNo solution existsUpgrade gupnp-develUpgrade gssdp-debuginfo | May 21, 2021 | Jun 8, 2020 |
| Rocky_linux | — | Upgrade gssdp-debugsourceUpgrade gssdpUpgrade gssdp-develUpgrade gssdp-debuginfo | Mar 12, 2024 | Jun 8, 2020 |
| Suse | — | Upgrade hostapdUpgrade minidlna | Dec 11, 2020 | Jun 8, 2020 |
| Ubuntu | — | Upgrade minidlnaUpgrade hostapd (Ubuntu Pro)Upgrade wpasupplicant (Ubuntu Pro)Upgrade libgupnp-1.2-0Upgrade hostapdUpgrade wpasupplicant | Sep 16, 2020 | Jun 8, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub