CVE-2020-12695

—

CVSS 3.1

7.5 high

EPSS

15%p97

Published

Jun 8, 2020 (Jun 8, 2020)

Modified

Jun 17, 2026

Description

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

Vendors: ui w1.fi asus broadcom canon cisco dlink dell epson hp huawei nec
Products: unifi controller, hostapd, rt-n11, adsl, selphy cp1200, wap131, wap150, wap351, dvg-n5412sp, b1165nfw, ep-101, ew-m970a3t
Weakness: CWE-276
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (15.2%)

In the news4 stories

UPnP vulnerability lets attackers steal data, scan internal networks

Help Net SecurityNov 14, 09:24 UTC · Nov 14, 2023Vulnerability CVE-2020-12695

Critical Root RCE Bug Affects Multiple Netgear SOHO Router Models

The Hacker NewsNov 18, 12:59 UTC · Nov 18, 2021Vulnerability CVE-2021-34991 CVE-2020-12695

Week in review: SMBGhost exploit, OneDrive security, PCI compliance misconceptions

Help Net SecurityJun 14, 00:00 UTC · Jun 14, 2020Ransomware CVE-2020-12695 CVE-2020-0796

The CallStranger UPnP vulnerability affects billions of devices

Security AffairsJun 9, 07:54 UTC · Jun 9, 2020Vulnerability CVE-2020-12695