miniupnpd vulnerabilities

An integer underflow vulnerability in miniupnpd's SOAPAction header parsing allows remote attackers to cause denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Improper length validation leads to an out-of-bounds memory read.

MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.

A vulnerability in Shibby Tomato 1.28 was found in an unknown function of the file usr/sbin/miniupnpd, leading to resource exhaustion. The attack can be launched remotely. This product is no longer supported by the maintainer.

In Shibby Tomato 1.28, the SUBSCRIBE Call Handler component's send function in usr/sbin/miniupnpd allows a Server-Side Request Forgery (SSRF) attack. The vulnerability can be exploited remotely. The project is superseded by FreshTomato and is no longer supported.