pupnp SDK
CVE-2026-41682
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable URI parsing with no auth or interaction required; impact limited to partial SSRF-style port confusion affecting confidentiality and integrity only.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.
AnalysisAI
Port confusion in pupnp's URI parser allows remote unauthenticated attackers to bypass port-based access controls by supplying port values exceeding 65535 in crafted URIs. The integer truncation caused by atoi() in parse_hostport() within uri.c causes the parsed port to wrap around (e.g., port 65537 resolves to port 1), enabling SSRF-style redirection to unintended internal services. All pupnp releases prior to 1.18.5 are affected; no confirmed active exploitation exists (EPSS 0.04%, no KEV listing), but SSVC rates the attack as automatable with partial technical impact.
Technical ContextAI
The vulnerability (CWE-195: Signed to Unsigned Conversion Error) resides in parse_hostport() in upnp/src/genlib/net/uri/uri.c. The original code used atoi() to convert port strings from incoming URIs to integers. atoi() performs no range validation and its return value, when subsequently stored in or compared against a 16-bit unsigned port type, wraps modulo 65536 - so a supplied port of 65537 is silently treated as port 1. The fix (commit def5f9a2) replaces atoi() with strtol() and adds explicit bounds checking (1-65535), returning UPNP_E_INVALID_URL for out-of-range values. Affected CPE is cpe:2.3:a:pupnp:pupnp:*:*:*:*:*:*:*:* covering all versions prior to 1.18.5. pupnp (libupnp) is the reference open-source UPnP SDK embedded in many IoT devices, media servers, and smart home software.
RemediationAI
Upgrade pupnp to version 1.18.5, the confirmed patched release available at https://github.com/pupnp/pupnp/releases/tag/release-1.18.5, which introduces strtol()-based port parsing with explicit 1-65535 range validation in parse_hostport(). The underlying commit is https://github.com/pupnp/pupnp/commit/def5f9a2bc42f5b3d713e37c516fbe840ce54b7b. For deployments that cannot immediately upgrade, a compensating control is to validate and reject port values outside the 1-65535 range in application code before passing URIs to pupnp's parse_uri() - note this adds application-layer logic that must be maintained across future pupnp updates. Network-level egress filtering to block outbound connections from UPnP services to privileged ports (1-1023) can reduce the blast radius of successful exploitation but does not prevent the underlying integer confusion.
A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() funct
The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. Rated critica
Same weakness CWE-195 – Signed to Unsigned Conversion Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today