EUVD-2026-102928Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed pupnp service
-
DeliverySend crafted attacker-controlled XML
-
ExploitApp invokes removeAttributeNode comparison
-
ExecutionixmlNode_compare passes NULL to strcmp
-
ImpactProcess crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The crash requires the embedding application to call ixmlElement_removeAttributeNode on attacker-controlled XML such that find_condition_node compares two DISTINCT attribute objects sharing the same nodeName - a situation that arises specifically for non-namespaced attributes created via ixmlDocument_createAttribute, which legitimately leave nodeValue/namespaceURI/prefix/localName NULL. The pointer-identity shortcut in ixmlNode_compare must not apply (distinct objects), so the NULL field reaches strcmp. LIMITING FACTORS: exploitation is unauthenticated and remote (PR:N/UI:N) but is NOT guaranteed against all pupnp deployments - it only triggers in applications whose code paths actually invoke attribute-node removal/comparison on untrusted XML; products that parse but never exercise this ixml path are not affected. Impact is confined to a process crash (availability); no code execution or data disclosure. Fixed in pupnp 2.0.2. |
| Impact | All impact signals point to a single, bounded outcome: denial of service. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) and CWE-476 (NULL pointer dereference) are internally consistent with the description - an unauthenticated, remote NULL dereference that crashes the process, with zero confidentiality or integrity impact (C:N/I:N). No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit code is referenced - the only 'source code evidence' supplied is the upstream fix commit (4b2f775), not a weaponized PoC. The headline 7.5/HIGH score is driven entirely by A:H; this is a crash bug, not an RCE or data-exposure issue, so it should be triaged as availability-only. One nuance limits real-world severity below what AV:N/AC:L/PR:N implies: the description states the crash only occurs 'when application handling of attacker-controlled XML reaches this path' - specifically when ixmlElement_removeAttributeNode compares two distinct same-nodeName attribute objects via find_condition_node. Exploitability therefore depends on how the downstream application that embeds pupnp uses the ixml API, which the CVSS base vector does not capture. Net: a real but availability-only priority for internet-exposed UPnP devices/services built on pupnp; low priority where the product is not network-reachable or does not exercise the removeAttributeNode path on untrusted XML. |
| Exploit ScenarioDerived | An attacker sends crafted XML (e.g. a UPnP SOAP/description payload) to a networked device or control point built on pupnp prior to 2.0.2. When the host application parses the document and manipulates attributes such that ixmlElement_removeAttributeNode compares two distinct non-namespaced attributes sharing a nodeName, ixmlNode_compare passes NULL namespaceURI/prefix/localName/nodeValue fields straight into strcmp, dereferencing NULL and crashing the process. No public exploit code is identified; only the upstream fix commit is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Denial of service in pupnp (portable UPnP SDK) versions prior to 2.0.2 affects remote, unauthenticated deployments whose applications parse attacker-controlled XML and invoke ixmlElement_removeAttributeNode, causing the process to crash when ixmlNode_compare passes NULL nodeValue, namespaceURI, prefix, or localName fields to strcmp. The NULL fields arise legitimately from non-namespaced attributes created by ixmlDocument_createAttribute, and the crash occurs only when find_condition_node compares two distinct attribute objects with the same nodeName so the pointer-identity shortcut does not apply. No public exploit code or active exploitation was identified at time of analysis, and the vendor fixed the issue in 2.0.2 via commit 4b2f775e; impact is limited to availability (CWE-476, CVSS 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no code execution or data disclosure.
RemediationAI
Upgrade to pupnp 2.0.2 (release tag release-2.0.2), which incorporates commit 4b2f775e3b98de3cfb096707bcde040c5562d9ec and replaces the raw strcmp calls in ixmlNode_compare with a NULL-safe safe_strcmp; vendor advisory GHSA-q54q-vx78-v9rq should be consulted for the full release notes. If immediate upgrade is not possible, the most direct compensating control is to avoid invoking ixmlElement_removeAttributeNode on attacker-controlled XML - either by removing or feature-gating that call path in the embedding application, with the trade-off that dynamic attribute removal functionality will be lost or degraded. Exposing UPnP XML parsing only to trusted networks or authenticated peers reduces the attack surface but may break interoperability in open UPnP environments, and running the affected service under a supervisor that restarts on crash with reduced privileges limits the availability impact without preventing the underlying NULL dereference. Because the flaw only manifests in applications that actually exercise this ixml comparison path, deployments that parse XML but never remove attributes through this API are not affected and can prioritize patching accordingly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is pupnp's bundled ixml XML parser, specifically ixml/src/node.c. ixmlNode_compare performs a structural comparison of two ixml nodes by calling strcmp on the nullable fields nodeValue, namespaceURI, prefix, and localName; non-namespaced attributes produced by ixmlDocument_createAttribute leave those fields as NULL by design. In ixmlElement_removeAttributeNode, the helper find_condition_node iterates candidate attributes and compares them against the target, but the pointer-identity fast path in ixmlNode_compare only avoids the strcmp call when both pointers are the same object. For two distinct attributes that share the same nodeName, the fast path does not trigger and the NULL field reaches strcmp, producing a NULL pointer dereference classified as CWE-476. The provided CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector matches the observed behavior: the primitive is network-reachable and unauthenticated, requires no user interaction, and yields only an availability impact (process crash). The upstream fix adds a safe_strcmp wrapper in commit 4b2f775e that treats two NULLs as equal and NULL versus non-NULL as unequal. The CPE cpe:2.3:a:pupnp:pupnp:*:*:*:*:*:*:*:* confirms the affected package is pupnp itself rather than a third-party product embedding it, though the practical trigger depends on the embedding application's code path.
Know when Pupnp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crafted XML (AV:N/PR:N/UI:N) reliably dereferences NULL once the removeAttributeNode path is reached (AC:L); impact is availability-only (C:N/I:N/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.
Technical POC Analysis
CWE-476 (NULL Pointer Dereference) in ixmlNodecompare, ixml/src/node.c (advisory cites lines 522-528; the PoC stack frame lands on node.c:524).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
pupnp, the portable UPnP SDK embedded in networked devices and applications, contains a remote, unauthenticated denial-of-service flaw in all versions prior to 2.0.2 that can crash any product parsing attacker-supplied XML through its ixml APIs. Organizations are exposed wherever pupnp-based software is reachable from untrusted networks - consumer media and smart-home platforms, network appliances, and OT/ICS gateways are typical examples - and repeated crashes can interrupt service for end users and customers without any attacker credentials. No public exploit code was identified at time of analysis and the vendor has published a fix in 2.0.2, so leadership should treat this as a manageable inventory-and-upgrade program rather than an emergency incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() funct
The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. Rated critica
Denial of service in pupnp (libupnp) releases prior to 22.0.4 lets remote unauthenticated attackers stall the UPnP minis
Denial of service in pupnp (the portable UPnP SDK) versions prior to 2.0.2 allows unauthenticated remote attackers to ex
Integer overflow in pupnp's HTTP Content-Length parser (raw_to_int in upnp/src/genlib/net/http/httpparser.c) allows a re
Port confusion in pupnp's URI parser allows remote unauthenticated attackers to bypass port-based access controls by sup
Stack exhaustion in pupnp (libupnp) before 2.0.0 allows an unauthenticated attacker on the local or adjacent network to
Exploit-DB