CVE-2026-107159
MediumCVSS 6.5Summary
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.
Risk Assessment
The attack can crash the UPnP daemon, leading to unavailability of the IGD service and potential network disruption.
Recommendation
Update MiniUPnPd to a patched version or configure a network firewall to block unauthorized multicast traffic on port 1900.
Other vulnerabilities in MiniUPnPd
See all- CVE-2026-5720Critical
An integer underflow vulnerability in miniupnpd's SOAPAction header parsing allows remote attackers to cause denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Improper length validation leads to an out-of-bounds memory read.
- CVE-2026-10069High
A vulnerability in Shibby Tomato 1.28 was found in an unknown function of the file usr/sbin/miniupnpd, leading to resource exhaustion. The attack can be launched remotely. This product is no longer supported by the maintainer.
- CVE-2026-10068High
In Shibby Tomato 1.28, the SUBSCRIBE Call Handler component's send function in usr/sbin/miniupnpd allows a Server-Side Request Forgery (SSRF) attack. The vulnerability can be exploited remotely. The project is superseded by FreshTomato and is no longer supported.
Original NVD description (English source)
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS