{"id":"CVE-2012-5962","aliases":["DSA-2614-1","DSA-2615-1","EUVD-2012-5836","GHSA-xhwh-qc34-g7xv","openSUSE-SU-2024:10300-1"],"status":"published","title":"Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP...","description":"Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long DeviceType (aka urn) field in a UDP packet.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.36925,"percentile":0.98521,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-119"],"published":"2013-01-31T21:00:00Z","modified":"2026-06-16T23:47:38Z","exploits":[{"source":"exploitdb","id":"EDB-24455","title":"Portable UPnP SDK - 'unique_service_name()' Remote Code Execution (Metasploit)","type":"remote","platform":"unix","date":"2013-02-05","verified":true,"url":"https://www.exploit-db.com/exploits/24455"}],"affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"libupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.6-5+squeeze1"}]}],"versions":["1:1.6.6-5"],"bundled":8},{"source":"osv","ecosystem":"Debian:6.0","package":"libupnp4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0~svn20100507-1+squeeze1"}]}],"versions":["1.8.0~svn20100507-1"],"bundled":8}],"products":[{"vendor":"portable_sdk_for_upnp_project","product":"portable_sdk_for_upnp"}],"references":[{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:098","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://tsd.dlink.com.tw/temp/PMD/12960/DSR-150N_A2_Release_Notes_FW_v1.05B64_WW.pdf","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://tsd.dlink.com.tw/temp/PMD/12879/DSR-500_500N_1000_1000N_A1_Release_Notes_FW_v1.08B77_WW.pdf","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.debian.org/security/2013/dsa-2615","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://tsd.dlink.com.tw/temp/PMD/12966/DSR-150_A1_A2_Release_Notes_FW_v1.08B44_WW.pdf","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://tsd.dlink.com.tw/temp/PMD/13039/DSR-250_250N_A1_A2_Release_Notes_FW_v1.08B44_WW_RU.pdf","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.debian.org/security/2013/dsa-2614","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securityfocus.com/bid/57602","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit"]},{"url":"https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://pupnp.sourceforge.net/ChangeLog","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.kb.cert.org/vuls/id/922681","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Patch","US Government Resource"]},{"url":"https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0037","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5962"},{"url":"https://github.com/advisories/GHSA-xhwh-qc34-g7xv"},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5965","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-5962","description":"Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long DeviceType (aka urn) field in a UDP packet.","status":"published","published":"2013-01-31T21:00:00Z","modified":"2024-08-06T21:21:28.382Z","updated_at":"2026-11-02T14:34:49.600255Z"}],"euvd":[{"id":"EUVD-2012-5836","description":"Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long DeviceType (aka urn) field in a UDP packet.","status":"published","published":"2013-01-31T21:00:00Z","modified":"2024-08-06T21:21:28Z","updated_at":"2026-11-03T01:56:03.550057Z"}],"ghsa":[{"id":"GHSA-xhwh-qc34-g7xv","title":"Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP...","description":"Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long DeviceType (aka urn) field in a UDP packet.","status":"published","published":"2022-05-17T04:08:51Z","modified":"2023-01-28T05:01:11Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:43:31.331394Z"}],"nvd":[{"id":"CVE-2012-5962","description":"Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long DeviceType (aka urn) field in a UDP packet.","status":"published","published":"2013-01-31T21:55:01.303Z","modified":"2026-06-16T23:47:38.583Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:17.375282Z"}],"osv":[{"id":"DSA-2614-1","title":"libupnp - several","status":"published","published":"2013-02-01T00:00:00Z","modified":"2026-03-09T01:21:07.438743Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"DSA-2615-1","title":"libupnp4 - several","status":"published","published":"2013-02-01T00:00:00Z","modified":"2026-03-09T01:22:49.408588Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"openSUSE-SU-2024:10300-1","title":"libupnp-devel-1.6.19-1.8 on GA media","description":"These are all security issues fixed in the libupnp-devel-1.6.19-1.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:48.223552Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}