CVE-2020-12695

high-risk

Published 2020-06-08

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

Do I need to act?

3.0% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / HIGH complexity

Affected Products (20)

Unifi Controller

Hostapd

Rt-N11

Adsl

Selphy Cp1200

Wap131

Wap150

Wap351

Dvg-N5412Sp

B1165Nfw

Ep-101

Ew-M970A3T

M571T

Xp-100

Xp-2101

Xp-2105

Xp-241

Xp-320

Xp-330

Xp-340

Affected Vendors

Hp Cisco Debian Microsoft Nec Broadcom Netgear Zyxel Dell Dlink Canonical Canon Fedoraproject Asus Huawei Epson Tp-Link Zte W1.Fi Ui Ruckussecurity

References (34)

Third Party Advisory http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Chec...

Mailing List http://www.openwall.com/lists/oss-security/2020/06/08/2

Third Party Advisory https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerabil...

Third Party Advisory https://github.com/corelight/callstranger-detector

Third Party Advisory https://github.com/yunuscadirci/CallStranger

Third Party Advisory https://lists.debian.org/debian-lts-announce/2020/08/msg00011.html

Third Party Advisory https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html

Third Party Advisory https://lists.debian.org/debian-lts-announce/2020/12/msg00017.html

Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory https://usn.ubuntu.com/4494-1/

Broken Link https://www.callstranger.com

Third Party Advisory https://www.debian.org/security/2020/dsa-4806

Third Party Advisory https://www.debian.org/security/2021/dsa-4898

Third Party Advisory https://www.kb.cert.org/vuls/id/339275

Third Party Advisory https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-univer...

Third Party Advisory http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Chec...

Mailing List http://www.openwall.com/lists/oss-security/2020/06/08/2

Third Party Advisory https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerabil...

and 14 more references

/ 100

high-risk

Severity 22/34 · High

Exploitability 6/34 · Minimal

Exposure 33/34 · Critical