Security vulnerabilities and automated fixes for upnp issues
2 posts found
A critical heap buffer overflow vulnerability was discovered and patched in the SSDP control point implementation (`ssdp_ctrlpt.c`), where multiple unbounded `strcpy` and `strcat` operations constructed HTTP request buffers without any length validation. Network-received SSDP response fields — including service type strings and location URLs — could be crafted by an attacker to exceed buffer boundaries, potentially enabling arbitrary code execution or denial of service. The fix replaces the unsa
A critical buffer overflow vulnerability was discovered in the UPnP TV device sample code (`tv_device.c`), where unchecked `strcpy` calls allowed network-adjacent attackers to overflow fixed-size buffers with crafted UPnP discovery strings. The fix replaces unbounded string copies with length-checked alternatives (`strlcpy`/`snprintf`), closing a classic CWE-120 attack vector that required zero authentication to exploit.