EUVD-2026-94308
GHSA-57wm-f7xc-rw5q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local network access
-
DeliveryCraft M-SEARCH with MX:0
-
ExploitMulticast to UDP port 1900
-
ExecutionTrigger divide-by-zero in ProcessSSDPData()
-
ImpactSIGFPE crashes daemon (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Division safety checks
|
| Exploitation Conditions | Exploitation requires that the target run a MiniUPnPd build (through 2.3.11) compiled with the non-default --strict option - standard builds are not affected, which is the primary limiting factor. The attacker must have adjacent/local-network access to reach the SSDP multicast group on UDP port 1900 (AV:A, not internet-routable by default), and must send an M-SEARCH datagram containing 'MX: 0' together with a known/valid ST value. No authentication (PR:N) or user interaction (UI:N) is needed, and impact is limited to denial of service of the UPnP IGD daemon; there is no data exposure or code execution. |
| Impact | This is a genuine but bounded availability risk, not a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scoring 7.1 confirms an adjacent-network, low-complexity, unauthenticated attack with no user interaction, but impact is strictly availability (VC:N/VI:N/VA:H) - a daemon crash via SIGFPE, with no confidentiality or integrity exposure and no code execution. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so exploitation is unconfirmed and no evidence of active abuse exists. A critical mitigating factor the raw score does not capture: the vulnerability only manifests in binaries built with the non-default --strict compile option, meaning most production deployments of MiniUPnPd are NOT affected. The signals are internally consistent (DoS-only, low privilege, adjacent reach) but the --strict build dependency sharply narrows the real-world attack surface, making this a lower-priority patch item than the 7.1 score alone suggests for most environments. |
| Exploit ScenarioDerived | An attacker on the same LAN segment as a router or IoT device running a --strict build of MiniUPnPd sends a single crafted multicast M-SEARCH SSDP datagram to UDP port 1900 containing 'MX: 0' and a valid ST header. The malformed MX value triggers a divide-by-zero in ProcessSSDPData(), raising SIGFPE and crashing the daemon, which removes UPnP IGD port-mapping service until restart. No authentication, user interaction, or exploit tooling is required, though no public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Denial of service in MiniUPnPd through 2.3.11: an unauthenticated attacker on the adjacent/local network can terminate the UPnP IGD daemon by sending a single multicast SSDP M-SEARCH datagram to UDP port 1900 containing an 'MX: 0' header together with a known/valid ST value, which trips a divide-by-zero (SIGFPE) inside ProcessSSDPData() and takes down UPnP IGD service. The flaw is reachable only in builds compiled with the non-default --strict option, which is the principal limiting factor; the result is a crash with no data exposure, integrity loss, or code execution. Exploitation status per available data: no public exploit identified at time of analysis, and no CISA KEV entry confirming active exploitation.
RemediationAI
Patch status: upstream fix available (PR/commit); released patched version not independently confirmed. Apply the upstream fix commit 8f13b7a5843f5270db684099c0a083f98869636a to miniupnpd/minissdp.c (it validates mx_value and rejects MX values <= 0), or upgrade to the MiniUPnPd release that incorporates it once available, then rebuild and restart the daemon. If rebuilding immediately is not possible, the most direct compensating control is to stop building the daemon with the non-default --strict option, since the crash path is unreachable without it; note the trade-off that --strict also suppresses HTTP GET request forwarding, so removing it can allow the daemon to be abused as an open HTTP proxy or reflection/amplification source, meaning you should pair that change with network restrictions. Alternatively, restrict SSDP/UPnP exposure: block inbound UDP 1900 from untrusted VLANs and WAN interfaces with a host or edge firewall rule, and firewall the UPnP IGD ports so only the intended LAN segment can reach the multicast group, accepting that this can break legitimate client auto-discovery for guest or segmented networks. Disabling UPnP IGD entirely (or setting upnp off in configuration) eliminates the attack surface at the cost of losing NAT traversal/port-mapping for applications, and rate-limiting or dropping multicast M-SEARCH packets carrying MX values less than 1 at the network edge provides mitigation without code changes. Monitor logs for the warning message added by the fix ("ignoring SSDP packet with invalid value for MX: header") or for SIGFPE/daemon restarts as an indicator of attempted exploitation, and consult the VulnCheck advisory at https://www.vulncheck.com/advisories/miniupnpd-through-2.3.11-divide-by-zero-dos-via-ssdp-m-search-mx-header and the upstream project at https://github.com/miniupnp/miniupnp for updated release guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MiniUPnPd is the reference UPnP Internet Gateway Device (IGD) daemon, and its SSDP component (miniupnpd/minissdp.c) parses M-SEARCH discovery requests sent to the SSDP multicast group on UDP port 1900. Per the UPnP Device Architecture v2.0, the MX header carries the maximum wait time in seconds and must be >= 1 (recommended < 5); the daemon uses that value to compute a randomized response delay so it does not answer every searcher simultaneously. The vulnerable code (CWE-369, Divide By Zero) sets mx_value and, in --strict builds, performs arithmetic on it without rejecting zero or negative values, so an attacker-supplied 'MX: 0' produces a division by zero, an uncaught SIGFPE, and immediate process termination. The upstream fix in commit 8f13b7a5843f5270db684099c0a083f98869636a introduces a sentinel convention (-1 = MX not set, -2 = invalid) and explicitly rejects mx_value <= 0 with a logged warning and an early return, so malformed M-SEARCH packets are dropped instead of crashing the daemon. Affected CPE: cpe:2.3:a:miniupnp_project:miniupnpd:*:*:*:*:*:*:*:*. Impact is availability-only: the assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects an adjacent-network, unauthenticated, low-complexity crash with high availability impact and no confidentiality or integrity effect.
Know when Miniupnpd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Adjacent SSDP multicast reach (AV:A), single crafted packet with no auth or interaction (AC:L/PR:N/UI:N), availability-only daemon crash so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.
Executive ViewAI
MiniUPnPd, a UPnP Internet Gateway Device daemon used in routers and embedded network appliances, can be crashed by a single crafted SSDP request when compiled with the non-default --strict option, disrupting UPnP IGD availability on the affected network segment. Per available data, no public exploit identified at time of analysis, and the flaw does not enable data exposure, integrity loss, or code execution, so the primary business concern is service availability rather than a breach. Leadership should confirm whether any production devices use the vulnerable --strict build and ensure the vendor's available patch is applied promptly.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP
The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attacke
Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of s
A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in copyIPv6
An AddPortMapping Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer derefer
A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutbo
A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutbo
The upnp_event_prepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak infor
The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process
Integer signedness error in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP Min
The ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote att
Integer underflow in miniupnpd's SOAPAction header parser triggers out-of-bounds memory reads, enabling adjacent network
Exploit-DB