pupnp SDK CVE-2026-41682

The vulnerable code path is triggered whenever pupnp's parse_uri() processes a URI containing a port component with a value outside the valid 16-bit range (1-65535). In practice, this requires an attacker to control URI input that reaches parse_hostport() - for example, UPnP SUBSCRIBE callback URLs submitted by a control point, location headers in UPnP discovery (SSDP) responses, or control URLs in UPnP device description XML. Exploitation is limited to pupnp-based applications acting as UPnP control points or otherwise consuming externally supplied URIs with port components; purely passive UPnP device implementations that do not process callback/location URIs from untrusted peers have a reduced but not eliminated attack surface. The CVSS 4.0 vector PR:N/UI:N/AV:N confirms no authentication or user interaction is required when attacker-controlled URI input is reachable over the network.

The CVSS 4.0 score of 6.9 with AV:N/AC:L/PR:N/UI:N reflects a network-accessible, low-complexity, unauthenticated path to partial confidentiality and integrity impact. However, real-world exploitation risk is substantially below what that score implies. EPSS is 0.04% at the 12th percentile - near the floor of known CVEs - indicating negligible observed exploitation activity. CISA SSVC confirms exploitation status as 'none' while noting the attack is automatable, a combination that suggests the precondition (attacker-controlled URI input reaching parse_uri) limits practical reach even though exploitation mechanics themselves are straightforward. No KEV listing corroborates the absence of active campaigns. The key tension is SSVC 'automatable: yes' against EPSS near zero - this likely reflects that exploitation is easy once the precondition is met, but the precondition (externally supplied URIs processed by a pupnp control point) is not universally present. Defenders should prioritize patching in deployments where the application processes callback URLs or location headers from untrusted UPnP peers.

An attacker sends a crafted UPnP SUBSCRIBE callback URI or device description location URL containing a port value such as 65537 to an application built on pupnp. The atoi() call in parse_hostport() produces a value that wraps to 1 after integer truncation, causing the UPnP control point to initiate a connection to port 1 on a target host rather than the stated port 65537. This bypasses port-based firewall rules or security checks that would have blocked access to the low-numbered port, potentially exposing internal administrative or legacy services. No public exploit code has been identified at time of analysis.