CVEvulnerability
CVE-2020-12695
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-06-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H
- CVSS 2.0 ([email protected])
- 7.8 HIGH — AV:N/AC:M/Au:N/C:P/I:N/A:C
- Weaknesses
- CWE-276
Description
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.
Affected configurations
• ui unifi controller
• w1.fi hostapd (< 2.0.0)
• asus rt-n11
• broadcom adsl
• canon selphy cp1200
• cisco wap131
• cisco wap150
• cisco wap351
• dlink dvg-n5412sp
• dell b1165nfw
• epson ep-101
• epson ew-m970a3t
• epson m571t
• epson xp-100
• epson xp-2101
• epson xp-2105
• epson xp-241
• epson xp-320
• epson xp-330
• epson xp-340
• epson xp-4100
• epson xp-4105
• epson xp-440
• epson xp-620
• epson xp-630
• epson xp-702
• epson xp-8500
• epson xp-8600
• epson xp-960
• epson xp-970
• hp 5020 z4a69a
• hp 5030 m2u92b
• hp 5030 z4a70a
• hp 5034 z4a74a
• hp 5660 f8b04a
• hp deskjet ink advantage 3456 a9t84c
• hp deskjet ink advantage 3545 a9t81a
• hp deskjet ink advantage 3545 a9t81c
• hp deskjet ink advantage 3545 a9t83b
• hp deskjet ink advantage 3546 a9t82a
• hp deskjet ink advantage 3548 a9t81b
• hp deskjet ink advantage 4515
• hp deskjet ink advantage 4518
• hp deskjet ink advantage 4535 f0v64a
• hp deskjet ink advantage 4535 f0v64b
• hp deskjet ink advantage 4535 f0v64c
• hp deskjet ink advantage 4536 f0v65a
• hp deskjet ink advantage 4538 f0v66b
• hp deskjet ink advantage 4675 f1h97a
• hp deskjet ink advantage 4675 f1h97b
• hp deskjet ink advantage 4675 f1h97c
• hp deskjet ink advantage 4676 f1h98a
• hp deskjet ink advantage 4678 f1h99b
• hp deskjet ink advantage 5575 g0v48b
• hp deskjet ink advantage 5575 g0v48c
• hp envy 100 cn517a
• hp envy 100 cn517b
• hp envy 100 cn517c
• hp envy 100 cn518a
• hp envy 100 cn519a
… and 159 more
Related
Weakness · CWE (1)
- CWE-276 Incorrect Default Permissions weakness
References
- http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2020/06/08/2 Mailing List, Third Party Advisory
- https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek/ Third Party Advisory
- https://github.com/corelight/callstranger-detector Third Party Advisory
- https://github.com/yunuscadirci/CallStranger Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00011.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/12/msg00017.html Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3SHL4LOFGHJ3DIXSUIQELGVBDJ7V7LB/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZDWHKGN3LMGSUEOAAVAMOD3IUIPJVOJ/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQEYVY4D7LASH6AI4WK3IK2QBFHHF3Q2/ Mailing List, Third Party Advisory
- https://usn.ubuntu.com/4494-1/ Third Party Advisory
- https://www.callstranger.com Broken Link
- https://www.debian.org/security/2020/dsa-4806 Third Party Advisory
- https://www.debian.org/security/2021/dsa-4898 Third Party Advisory
- https://www.kb.cert.org/vuls/id/339275 Third Party Advisory, US Government Resource
- https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of Third Party Advisory
- http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2020/06/08/2 Mailing List, Third Party Advisory
- https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek/ Third Party Advisory
- https://github.com/corelight/callstranger-detector Third Party Advisory
- https://github.com/yunuscadirci/CallStranger Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00011.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/12/msg00017.html Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3SHL4LOFGHJ3DIXSUIQELGVBDJ7V7LB/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZDWHKGN3LMGSUEOAAVAMOD3IUIPJVOJ/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQEYVY4D7LASH6AI4WK3IK2QBFHHF3Q2/ Mailing List, Third Party Advisory
- https://usn.ubuntu.com/4494-1/ Third Party Advisory
- https://www.callstranger.com Broken Link
- https://www.debian.org/security/2020/dsa-4806 Third Party Advisory
- https://www.debian.org/security/2021/dsa-4898 Third Party Advisory
- https://www.kb.cert.org/vuls/id/339275 Third Party Advisory, US Government Resource
- https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of Third Party Advisory