CallStranger Vulnerability in Many Common UPnP Devices

Summary

A new vulnerability, dubbed CallStranger, was discovered in the Universal Plug and Play (UPnP) network protocol managed by the Open Connectivity Foundation (OCF). The CallStranger vulnerability is caused by the Callback header value in the UPnP SUBSCRIBE function that can be exploited to bypass network security devices, scan networks, exfiltrate data, and launch distributed denial-of-service (DDoS) attacks. Many UPnP devices—such as routers, printers, and Internet of Things (IoT) devices—are affected and will need vendor patches or mitigation measures put in place.

Recommendations

The NJCCIC recommends users apply patches when available after appropriate testing. Users are advised to refer to OCF’s updated UPnP specification and review the CallStranger website for detailed information, affected devices, and mitigation options.