CVE Feed

    Dashboard / CVE / CVE-2020-12695

    CVE-2020-12695

    The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

    Published:Jun 8, 2020
    Last Modified:Nov 21, 2024
    EPS:Jun 8, 2020
    EPSS Score:0.03213
    CVSS Score:7.5

    Affected Products

    Vendor
    Asus
    Product
    Rt-n11
    Vendor
    Broadcom
    Product
    Adsl
    Vendor
    Canon
    Product
    Selphy Cp1200
    Vendor
    Canonical
    Product
    Ubuntu Linux
    Vendor
    Cisco
    Product
    Wap131
    Vendor
    Cisco
    Product
    Wap150
    Vendor
    Cisco
    Product
    Wap351
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Dell
    Product
    B1165nfw
    Vendor
    Dlink
    Product
    Dvg-n5412sp
    Vendor
    Epson
    Product
    Ep-101
    Vendor
    Epson
    Product
    Ew-m970a3t
    Vendor
    Epson
    Product
    M571t
    Vendor
    Epson
    Product
    Xp-100
    Vendor
    Epson
    Product
    Xp-2101
    Vendor
    Epson
    Product
    Xp-2105
    Vendor
    Epson
    Product
    Xp-241
    Vendor
    Epson
    Product
    Xp-320
    Vendor
    Epson
    Product
    Xp-330
    Vendor
    Epson
    Product
    Xp-340
    Vendor
    Epson
    Product
    Xp-4100
    Vendor
    Epson
    Product
    Xp-4105
    Vendor
    Epson
    Product
    Xp-440
    Vendor
    Epson
    Product
    Xp-620
    Vendor
    Epson
    Product
    Xp-630
    Vendor
    Epson
    Product
    Xp-702
    Vendor
    Epson
    Product
    Xp-8500
    Vendor
    Epson
    Product
    Xp-8600
    Vendor
    Epson
    Product
    Xp-960
    Vendor
    Epson
    Product
    Xp-970
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Hp
    Product
    5020 Z4a69a
    Vendor
    Hp
    Product
    5030 M2u92b
    Vendor
    Hp
    Product
    5030 Z4a70a
    Vendor
    Hp
    Product
    5034 Z4a74a
    Vendor
    Hp
    Product
    5660 F8b04a
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 3456 A9t84c
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 3545 A9t81a
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 3545 A9t81c
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 3545 A9t83b
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 3546 A9t82a
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 3548 A9t81b
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4515
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4518
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4535 F0v64a
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4535 F0v64b
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4535 F0v64c
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4536 F0v65a
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4538 F0v66b
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4675 F1h97a
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4675 F1h97b
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4675 F1h97c
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4676 F1h98a
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 4678 F1h99b
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 5575 G0v48b
    Vendor
    Hp
    Product
    Deskjet Ink Advantage 5575 G0v48c
    Vendor
    Hp
    Product
    Envy 100 Cn517a
    Vendor
    Hp
    Product
    Envy 100 Cn517b
    Vendor
    Hp
    Product
    Envy 100 Cn517c
    Vendor
    Hp
    Product
    Envy 100 Cn518a
    Vendor
    Hp
    Product
    Envy 100 Cn519a
    Vendor
    Hp
    Product
    Envy 100 Cn519b
    Vendor
    Hp
    Product
    Envy 110 Cq809a
    Vendor
    Hp
    Product
    Envy 110 Cq809b
    Vendor
    Hp
    Product
    Envy 110 Cq809c
    Vendor
    Hp
    Product
    Envy 110 Cq809d
    Vendor
    Hp
    Product
    Envy 110 Cq812c
    Vendor
    Hp
    Product
    Envy 111 Cq810a
    Vendor
    Hp
    Product
    Envy 114 Cq811a
    Vendor
    Hp
    Product
    Envy 114 Cq811b
    Vendor
    Hp
    Product
    Envy 114 Cq812a
    Vendor
    Hp
    Product
    Envy 120 Cz022a
    Vendor
    Hp
    Product
    Envy 120 Cz022b
    Vendor
    Hp
    Product
    Envy 120 Cz022c
    Vendor
    Hp
    Product
    Envy 4500 A9t80a
    Vendor
    Hp
    Product
    Envy 4500 A9t80b
    Vendor
    Hp
    Product
    Envy 4500 A9t89a
    Vendor
    Hp
    Product
    Envy 4500 D3p93a
    Vendor
    Hp
    Product
    Envy 4501 C8d05a
    Vendor
    Hp
    Product
    Envy 4502 A9t85a
    Vendor
    Hp
    Product
    Envy 4502 A9t87b
    Vendor
    Hp
    Product
    Envy 4503 E6g71b
    Vendor
    Hp
    Product
    Envy 4504 A9t88b
    Vendor
    Hp
    Product
    Envy 4504 C8d04a
    Vendor
    Hp
    Product
    Envy 4505 A9t86a
    Vendor
    Hp
    Product
    Envy 4507 E6g70b
    Vendor
    Hp
    Product
    Envy 4508 E6g72b
    Vendor
    Hp
    Product
    Envy 4509 D3p94a
    Vendor
    Hp
    Product
    Envy 4509 D3p94b
    Vendor
    Hp
    Product
    Envy 4511 K9h50a
    Vendor
    Hp
    Product
    Envy 4512 K9h49a
    Vendor
    Hp
    Product
    Envy 4513 K9h51a
    Vendor
    Hp
    Product
    Envy 4516 K9h52a
    Vendor
    Hp
    Product
    Envy 4520 E6g67a
    Vendor
    Hp
    Product
    Envy 4520 E6g67b
    Vendor
    Hp
    Product
    Envy 4520 F0v63a
    Vendor
    Hp
    Product
    Envy 4520 F0v63b
    Vendor
    Hp
    Product
    Envy 4520 F0v69a
    Vendor
    Hp
    Product
    Envy 4521 K9t10b
    Vendor
    Hp
    Product
    Envy 4522 F0v67a
    Vendor
    Hp
    Product
    Envy 4523 J6u60b
    Vendor
    Hp
    Product
    Envy 4524 F0v71b
    Vendor
    Hp
    Product
    Envy 4524 F0v72b
    Vendor
    Hp
    Product
    Envy 4524 K9t01a
    Vendor
    Hp
    Product
    Envy 4525 K9t09b
    Vendor
    Hp
    Product
    Envy 4526 K9t05b
    Vendor
    Hp
    Product
    Envy 4527 J6u61b
    Vendor
    Hp
    Product
    Envy 4528 K9t08b
    Vendor
    Hp
    Product
    Envy 5000 M2u85a
    Vendor
    Hp
    Product
    Envy 5000 M2u85b
    Vendor
    Hp
    Product
    Envy 5000 M2u91a
    Vendor
    Hp
    Product
    Envy 5000 M2u94b
    Vendor
    Hp
    Product
    Envy 5000 Z4a54a
    Vendor
    Hp
    Product
    Envy 5000 Z4a74a
    Vendor
    Hp
    Product
    Envy 5020 M2u91b
    Vendor
    Hp
    Product
    Envy 5530
    Vendor
    Hp
    Product
    Envy 5531
    Vendor
    Hp
    Product
    Envy 5532
    Vendor
    Hp
    Product
    Envy 5534
    Vendor
    Hp
    Product
    Envy 5535
    Vendor
    Hp
    Product
    Envy 5536
    Vendor
    Hp
    Product
    Envy 5539
    Vendor
    Hp
    Product
    Envy 5540 F2e72a
    Vendor
    Hp
    Product
    Envy 5540 G0v47a
    Vendor
    Hp
    Product
    Envy 5540 G0v51a
    Vendor
    Hp
    Product
    Envy 5540 G0v52a
    Vendor
    Hp
    Product
    Envy 5540 G0v53a
    Vendor
    Hp
    Product
    Envy 5540 K7c85a
    Vendor
    Hp
    Product
    Envy 5541 K7g89a
    Vendor
    Hp
    Product
    Envy 5542 K7c88a
    Vendor
    Hp
    Product
    Envy 5543 N9u88a
    Vendor
    Hp
    Product
    Envy 5544 K7c89a
    Vendor
    Hp
    Product
    Envy 5544 K7c93a
    Vendor
    Hp
    Product
    Envy 5545 G0v50a
    Vendor
    Hp
    Product
    Envy 5546 K7c90a
    Vendor
    Hp
    Product
    Envy 5547 J6u64a
    Vendor
    Hp
    Product
    Envy 5548 K7g87a
    Vendor
    Hp
    Product
    Envy 5640 B9s56a
    Vendor
    Hp
    Product
    Envy 5640 B9s58a
    Vendor
    Hp
    Product
    Envy 5642 B9s64a
    Vendor
    Hp
    Product
    Envy 5643 B9s63a
    Vendor
    Hp
    Product
    Envy 5644 B9s65a
    Vendor
    Hp
    Product
    Envy 5646 F8b05a
    Vendor
    Hp
    Product
    Envy 5664 F8b08a
    Vendor
    Hp
    Product
    Envy 5665 F8b06a
    Vendor
    Hp
    Product
    Envy 6020 5se16b
    Vendor
    Hp
    Product
    Envy 6020 5se17a
    Vendor
    Hp
    Product
    Envy 6020 6wd35a
    Vendor
    Hp
    Product
    Envy 6020 7cz37a
    Vendor
    Hp
    Product
    Envy 6052 5se18a
    Vendor
    Hp
    Product
    Envy 6055 5se16a
    Vendor
    Hp
    Product
    Envy 6540 B9s59a
    Vendor
    Hp
    Product
    Envy 7640
    Vendor
    Hp
    Product
    Envy 7644 E4w46a
    Vendor
    Hp
    Product
    Envy 7645 E4w44a
    Vendor
    Hp
    Product
    Envy Photo 6200 K7g18a
    Vendor
    Hp
    Product
    Envy Photo 6200 K7g26b
    Vendor
    Hp
    Product
    Envy Photo 6200 K7s21b
    Vendor
    Hp
    Product
    Envy Photo 6200 Y0k13d
    Vendor
    Hp
    Product
    Envy Photo 6200 Y0k15a
    Vendor
    Hp
    Product
    Envy Photo 6220 K7g20d
    Vendor
    Hp
    Product
    Envy Photo 6220 K7g21b
    Vendor
    Hp
    Product
    Envy Photo 6222 Y0k13d
    Vendor
    Hp
    Product
    Envy Photo 6222 Y0k14d
    Vendor
    Hp
    Product
    Envy Photo 6230 K7g25b
    Vendor
    Hp
    Product
    Envy Photo 6232 K7g26b
    Vendor
    Hp
    Product
    Envy Photo 6234 K7s21b
    Vendor
    Hp
    Product
    Envy Photo 6252 K7g22a
    Vendor
    Hp
    Product
    Envy Photo 7100 3xd89a
    Vendor
    Hp
    Product
    Envy Photo 7100 K7g93a
    Vendor
    Hp
    Product
    Envy Photo 7100 K7g99a
    Vendor
    Hp
    Product
    Envy Photo 7100 Z3m37a
    Vendor
    Hp
    Product
    Envy Photo 7100 Z3m52a
    Vendor
    Hp
    Product
    Envy Photo 7120 Z3m41d
    Vendor
    Hp
    Product
    Envy Photo 7155 Z3m52a
    Vendor
    Hp
    Product
    Envy Photo 7164 K7g99a
    Vendor
    Hp
    Product
    Envy Photo 7800 K7r96a
    Vendor
    Hp
    Product
    Envy Photo 7800 K7s00a
    Vendor
    Hp
    Product
    Envy Photo 7800 K7s10d
    Vendor
    Hp
    Product
    Envy Photo 7800 Y0g42d
    Vendor
    Hp
    Product
    Envy Photo 7800 Y0g52b
    Vendor
    Hp
    Product
    Envy Photo 7822 Y0g42d
    Vendor
    Hp
    Product
    Envy Photo 7822 Y0g43d
    Vendor
    Hp
    Product
    Envy Photo 7830 Y0g50b
    Vendor
    Hp
    Product
    Envy Pro 6420 5se45b
    Vendor
    Hp
    Product
    Envy Pro 6420 5se46a
    Vendor
    Hp
    Product
    Envy Pro 6420 6wd14a
    Vendor
    Hp
    Product
    Envy Pro 6420 6wd16a
    Vendor
    Hp
    Product
    Envy Pro 6452 5se47a
    Vendor
    Hp
    Product
    Envy Pro 6455 5se45a
    Vendor
    Hp
    Product
    Officejet 4650 E6g87a
    Vendor
    Hp
    Product
    Officejet 4650 F1h96a
    Vendor
    Hp
    Product
    Officejet 4650 F1h96b
    Vendor
    Hp
    Product
    Officejet 4652 F1j02a
    Vendor
    Hp
    Product
    Officejet 4652 F1j05b
    Vendor
    Hp
    Product
    Officejet 4652 K9v84b
    Vendor
    Hp
    Product
    Officejet 4654 F1j06b
    Vendor
    Hp
    Product
    Officejet 4654 F1j07b
    Vendor
    Hp
    Product
    Officejet 4655 F1j00a
    Vendor
    Hp
    Product
    Officejet 4655 K9v79a
    Vendor
    Hp
    Product
    Officejet 4655 K9v82b
    Vendor
    Hp
    Product
    Officejet 4656 K9v81b
    Vendor
    Hp
    Product
    Officejet 4657 V6d29b
    Vendor
    Hp
    Product
    Officejet 4658 V6d30b
    Vendor
    Huawei
    Product
    Hg255s
    Vendor
    Huawei
    Product
    Hg532e
    Vendor
    Microsoft
    Product
    Windows 10
    Vendor
    Microsoft
    Product
    Xbox One
    Vendor
    Nec
    Product
    Wr8165n
    Vendor
    Netgear
    Product
    Wnhde111
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Ruckussecurity
    Product
    Zonedirector 1200
    Vendor
    Tp-link
    Product
    Archer C50
    Vendor
    Ui
    Product
    Unifi Controller
    Vendor
    W1.fi
    Product
    Hostapd
    Vendor
    Zte
    Product
    Zxv10 W300
    Vendor
    Zyxel
    Product
    Amg1202-t10b
    Vendor
    Zyxel
    Product
    Vmg8324-b10a

    Exploits

    https://github.com/corelight/callstranger-detectorhttps://github.com/yunuscadirci/CallStranger

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
    CAPEC-10 Buffer Overflow via Environment Variables
    CAPEC-101 Server Side Include (SSI) Injection
    CAPEC-104 Cross Zone Scripting
    CAPEC-108 Command Line Execution through SQL Injection
    CAPEC-109 Object Relational Mapping Injection
    CAPEC-110 SQL Injection through SOAP Parameter Tampering
    CAPEC-120 Double Encoding
    CAPEC-127 Directory Indexing
    CAPEC-13 Subverting Environment Variable Values
    CAPEC-135 Format String Injection
    CAPEC-136 LDAP Injection
    CAPEC-14 Client-side Injection-induced Buffer Overflow
    CAPEC-147 XML Ping of the Death
    CAPEC-153 Input Data Manipulation
    CAPEC-182 Flash Injection
    CAPEC-209 XSS Using MIME Type Mismatch
    CAPEC-22 Exploiting Trust in Client
    CAPEC-227 Sustained Client Engagement
    CAPEC-23 File Content Injection
    CAPEC-230 Serialized Data with Nested Payloads
    CAPEC-231 Oversized Serialized Data Payloads
    CAPEC-24 Filter Failure through Buffer Overflow
    CAPEC-250 XML Injection
    CAPEC-261 Fuzzing for garnering other adjacent user/sensitive data
    CAPEC-267 Leverage Alternate Encoding
    CAPEC-28 Fuzzing
    CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
    CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies
    CAPEC-42 MIME Conversion
    CAPEC-43 Exploiting Multiple Input Interpretation Layers
    CAPEC-45 Buffer Overflow via Symbolic Links
    CAPEC-46 Overflow Variables and Tags
    CAPEC-47 Buffer Overflow via Parameter Expansion
    CAPEC-473 Signature Spoof
    CAPEC-492 Regular Expression Exponential Blowup
    CAPEC-52 Embedding NULL Bytes
    CAPEC-53 Postfix, Null Terminate, and Backslash
    CAPEC-588 DOM-Based XSS
    CAPEC-63 Cross-Site Scripting (XSS)
    CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
    CAPEC-664 Server Side Request Forgery
    CAPEC-67 String Format Overflow in syslog()
    CAPEC-7 Blind SQL Injection
    CAPEC-71 Using Unicode Encoding to Bypass Validation Logic
    CAPEC-72 URL Encoding
    CAPEC-73 User-Controlled Filename
    CAPEC-78 Using Escaped Slashes in Alternate Encoding
    CAPEC-79 Using Slashes in Alternate Encoding
    CAPEC-8 Buffer Overflow in an API Call
    CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic
    CAPEC-81 Web Server Logs Tampering
    CAPEC-83 XPath Injection
    CAPEC-85 AJAX Footprinting
    CAPEC-88 OS Command Injection
    CAPEC-9 Buffer Overflow in Local Command-Line Utilities

    References

    http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html
    http://www.openwall.com/lists/oss-security/2020/06/08/2
    https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek/
    https://github.com/corelight/callstranger-detector
    https://github.com/yunuscadirci/CallStranger
    https://lists.debian.org/debian-lts-announce/2020/08/msg00011.html
    https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html
    https://lists.debian.org/debian-lts-announce/2020/12/msg00017.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3SHL4LOFGHJ3DIXSUIQELGVBDJ7V7LB/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZDWHKGN3LMGSUEOAAVAMOD3IUIPJVOJ/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQEYVY4D7LASH6AI4WK3IK2QBFHHF3Q2/
    https://usn.ubuntu.com/4494-1/
    https://www.callstranger.com
    https://www.debian.org/security/2020/dsa-4806
    https://www.debian.org/security/2021/dsa-4898
    https://www.kb.cert.org/vuls/id/339275
    https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of
    http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html
    http://www.openwall.com/lists/oss-security/2020/06/08/2
    https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek/
    https://github.com/corelight/callstranger-detector
    https://github.com/yunuscadirci/CallStranger
    https://lists.debian.org/debian-lts-announce/2020/08/msg00011.html
    https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html
    https://lists.debian.org/debian-lts-announce/2020/12/msg00017.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3SHL4LOFGHJ3DIXSUIQELGVBDJ7V7LB/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZDWHKGN3LMGSUEOAAVAMOD3IUIPJVOJ/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQEYVY4D7LASH6AI4WK3IK2QBFHHF3Q2/
    https://usn.ubuntu.com/4494-1/
    https://www.callstranger.com
    https://www.debian.org/security/2020/dsa-4806
    https://www.debian.org/security/2021/dsa-4898
    https://www.kb.cert.org/vuls/id/339275
    https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High