CVE-2012-5961

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP...

10.0 HighPublic exploit

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long UDN (aka device) field in a UDP packet.

Exploit likelihood

36.9%Up 24.7 points since Feb 4, 2022

What each source reports

NVD Score used10.0

Record: CVE-2012-5961
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2012-5961
Updated: 2026-11-02

EUVDEUVD-2012-5835No score

Record: EUVD-2012-5835
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v863-m26m-45h8No score

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP...

Record: GHSA-v863-m26m-45h8
Weakness: CWE-119
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10300-1No score

libupnp-devel-1.6.19-1.8 on GA media

These are all security issues fixed in the libupnp-devel-1.6.19-1.8 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10300-1
Updated: 2026-11-02

Affected products

libupnp project libupnp

Affected packages

Affected packages
Package	Affected	Fixed
`libupnp` Debian:6.0 From an advisory covering 8 CVEs	before 1:1.6.6-5+squeeze1, plus listed versions 1:1.6.6-5	1:1.6.6-5+squeeze1
`libupnp4` Debian:6.0 From an advisory covering 8 CVEs	before 1.8.0~svn20100507-1+squeeze1, plus listed versions 1.8.0~svn20100507-1	1.8.0~svn20100507-1+squeeze1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)	2013-02-05

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-5961 is a high vulnerability (CVSS 10.0) in Libupnp Project Libupnp, published January 31, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 36.9%, the 98th percentile. No source names a fixed version.

References

Show 19 moreShow less