CVE-2016-6255

High

Published: 07/03/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Portable UPnP SDK (libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.

Risk Assessment

Attackers can exploit this vulnerability to inject malicious code or manipulate data in the system, potentially leading to serious security breaches.

Recommendation

It is recommended to update Portable UPnP SDK to version 1.6.21 or later to mitigate this vulnerability.

Other vulnerabilities in Portable UPnP SDK (libupnp)

CVE-2016-8863Critical
CVE-2016-8863 describes a heap-based buffer overflow in the create_url_list function in Portable UPnP SDK before version 1.6.21. This vulnerability allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code by sending a valid URI followed by an invalid one in the CALLBACK header of a SUBSCRIBE request.

Original NVD description (English source)

Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.