CVE-2012-5963
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP...
CVE-2012-5963 is a high vulnerability (CVSS 10.0) in Portable Sdk For Upnp Project Sdk For Upnp, published January 31, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 36.9%, the 98th percentile. Fixed in libupnp 1:1.6.6-5+squeeze1.
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long UDN (aka uuid) field within a string that lacks a :: (colon colon) in a UDP packet.
Exploit likelihood
What each source reports
NVD Score used
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long UDN (aka uuid) field within a string that lacks a :: (colon colon) in a UDP packet.
- Record
CVE-2012-5963- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long UDN (aka uuid) field within a string that lacks a :: (colon colon) in a UDP packet.
- Record
CVE-2012-5963- Updated
- 2026-11-02
EUVDEUVD-2012-5837 No score
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long UDN (aka uuid) field within a string that lacks a :: (colon colon) in a UDP packet.
- Record
EUVD-2012-5837- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f3q3-qwfv-hrff No score
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP...
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long UDN (aka uuid) field within a string that lacks a :: (colon colon) in a UDP packet.
- Record
GHSA-f3q3-qwfv-hrff- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10300-1 No score
libupnp-devel-1.6.19-1.8 on GA media
These are all security issues fixed in the libupnp-devel-1.6.19-1.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10300-1- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit) | 2013-02-05 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
mandriva.com/security/advisories?name=MDVSA-2013:098
tsd.dlink.com.tw/temp/PMD/12960/DSR-150N_A2_Release_Notes_FW_v1.05B64_WW.pdf
community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf
debian.org/security/2013/dsa-2615
Show 19 moreShow less
securityfocus.com/bid/57602
pupnp.sourceforge.net/ChangeLog
kb.cert.org/vuls/id/922681
wiki.mageia.org/en/Support/Advisories/MGASA-2013-0037
nvd.nist.gov/vuln/detail/CVE-2012-5963
github.com/advisories/GHSA-f3q3-qwfv-hrff
suse.com/security/cve/CVE-2012-5958