SB2026110644 - Multiple vulnerabilities in PUPnP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110644

SB2026110644 - Multiple vulnerabilities in PUPnP

Published: November 6, 2026

Security Bulletin ID SB2026110644
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read files outside a configured non-empty document root that the PUPnP web server process can access.

The vulnerability exists due to confinement checks stopping at the first decoded question mark or hash character while the built-in web server opens the entire path. An unauthenticated remote attacker can send traversal requests on Windows, or on other systems when the document root contains a directory whose name includes either character, to disclose file contents.


2) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated adjacent-network attacker to crash a host process embedding PUPnP, denying service.

The vulnerability exists due to incorrect buffer sizing when PUPnP copies GENA subscription callback URLs containing embedded NUL bytes. An unauthenticated adjacent-network attacker can send a crafted SUBSCRIBE request to the device's reachable HTTP port, triggering a heap out-of-bounds read when the application accepts the subscription and sends an event to a callback IP permitted by its delivery policy.


3) Incorrect calculation (CVE-ID: N/A)

CWE-ID: CWE-682 - Incorrect Calculation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to exhaust PUPnP miniserver workers and deny access to the device's HTTP service.

The vulnerability exists due to an incorrect receive timeout calculation in PUPnP's socket handling that converts the remaining timeout into an indefinite wait when a byte arrives just after the deadline. An unauthenticated remote attacker can hold eleven connections from two source addresses open to block legitimate requests until the connections are closed.


4) Access of Uninitialized Pointer (CVE-ID: N/A)

CWE-ID: CWE-824 - Access of Uninitialized Pointer

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated adjacent-network attacker to crash a PUPnP control point that downloads XML descriptions from discovered devices, causing denial of service.

The vulnerability exists due to HTTP status 0 being interpreted as success in UpnpDownloadXmlDoc(), leaving a pointer uninitialized when the response body is nonempty. An unauthenticated adjacent-network attacker can advertise a malicious device through SSDP and return such a description response, triggering an invalid pointer access or release.


Remediation

Install update from vendor's website.

References