The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade gupnp-develUpgrade gssdp-docsUpgrade gssdp-develUpgrade gssdp | May 4, 2022 | Jun 8, 2020 |
| Alpine Linux | — | Upgrade minidlnaUpgrade hostapd | Jul 9, 2020 | Jun 8, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 8, 2020 |
| Centos_linux | — | Upgrade gssdp-debugsourceUpgrade gupnp-debuginfoUpgrade gssdpUpgrade gssdp-debuginfoUpgrade gupnpUpgrade gupnp-debugsourceUpgrade gssdp-utils-debuginfo | Jun 1, 2021 | Jun 8, 2020 |
| Debian | — | Upgrade gupnpUpgrade wpaUpgrade minidlna | Aug 10, 2020 | Jun 8, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade wpa_supplicant | Feb 22, 2021 | Jun 8, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade wpa_supplicant | Jan 20, 2021 | Jun 8, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade wpa_supplicant | Nov 2, 2020 | Jun 8, 2020 |
| Oracle Solaris | — | Upgrade library/desktop/gssdp to version 1.0.5-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/desktop/gupnp to version 1.0.6-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/desktop/gupnp-igd to version 0.2.5-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Jun 8, 2020 |
| Oracle_linux | — | Upgrade gssdp-develUpgrade gupnpUpgrade gssdp-docsUpgrade gssdpUpgrade gupnp-devel | May 26, 2021 | Jun 8, 2020 |
| Redhat_linux | — | No solution existsUpgrade gssdp-debuginfoUpgrade gupnp-develUpgrade gupnp-debugsourceUpgrade gssdp-docsUpgrade gupnpUpgrade gupnp-debuginfoUpgrade gssdpUpgrade gssdp-develUpgrade gssdp-utils-debuginfoUpgrade gssdp-debugsource | May 21, 2021 | Jun 8, 2020 |
| Rocky_linux | — | Upgrade gssdp-debugsourceUpgrade gssdp-debuginfoUpgrade gssdpUpgrade gssdp-devel | Mar 12, 2024 | Jun 8, 2020 |
| Suse | — | Upgrade minidlnaUpgrade hostapd | Dec 11, 2020 | Jun 8, 2020 |
| Ubuntu | — | Upgrade wpasupplicantUpgrade hostapdUpgrade libgupnp-1.2-0Upgrade wpasupplicant (Ubuntu Pro)Upgrade hostapd (Ubuntu Pro)Upgrade minidlna | Sep 16, 2020 | Jun 8, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub