The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-gssdpalma-upgrade-gssdp-develalma-upgrade-gssdp-docsalma-upgrade-gupnp-devel | May 4, 2022 | Jun 8, 2020 | |
| Alpine Linux | alpine-linux-upgrade-hostapdalpine-linux-upgrade-minidlna | Jul 9, 2020 | Jun 8, 2020 | |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Jun 8, 2020 |
| Centos_linux | — | centos-upgrade-gssdpcentos-upgrade-gssdp-debuginfocentos-upgrade-gssdp-debugsourcecentos-upgrade-gssdp-utils-debuginfocentos-upgrade-gupnpcentos-upgrade-gupnp-debuginfocentos-upgrade-gupnp-debugsource | Jun 1, 2021 | Jun 8, 2020 |
| Debian | debian-upgrade-gupnpdebian-upgrade-minidlnadebian-upgrade-wpa | Aug 10, 2020 | Jun 8, 2020 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-wpa_supplicant | Feb 22, 2021 | Jun 8, 2020 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-wpa_supplicant | Jan 20, 2021 | Jun 8, 2020 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-wpa_supplicant | Nov 2, 2020 | Jun 8, 2020 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-library-desktop-gssdp-1-0-5-11-4-30-0-1-88-0oracle-solaris-11-4-upgrade-library-desktop-gupnp-1-0-6-11-4-30-0-1-88-0oracle-solaris-11-4-upgrade-library-desktop-gupnp-igd-0-2-5-11-4-30-0-1-88-0 | Feb 17, 2021 | Jun 8, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-gssdporacle-linux-upgrade-gssdp-develoracle-linux-upgrade-gssdp-docsoracle-linux-upgrade-gupnporacle-linux-upgrade-gupnp-devel | May 26, 2021 | Jun 8, 2020 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-gssdpredhat-upgrade-gssdp-debuginforedhat-upgrade-gssdp-debugsourceredhat-upgrade-gssdp-develredhat-upgrade-gssdp-docsredhat-upgrade-gssdp-utils-debuginforedhat-upgrade-gupnpredhat-upgrade-gupnp-debuginforedhat-upgrade-gupnp-debugsourceredhat-upgrade-gupnp-devel | May 21, 2021 | Jun 8, 2020 | |
| Rocky_linux | rocky-upgrade-gssdprocky-upgrade-gssdp-debuginforocky-upgrade-gssdp-debugsourcerocky-upgrade-gssdp-devel | Mar 12, 2024 | Jun 8, 2020 | |
| Suse | — | suse-upgrade-hostapdsuse-upgrade-minidlna | Dec 11, 2020 | Jun 8, 2020 |
| Ubuntu | ubuntu-pro-upgrade-hostapdubuntu-pro-upgrade-wpasupplicantubuntu-upgrade-hostapdubuntu-upgrade-libgupnp-1-2-0ubuntu-upgrade-minidlnaubuntu-upgrade-wpasupplicant | Sep 16, 2020 | Jun 8, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub