Vulnerability · Published Jun 8, 2020 · Assigned by mitre
CVE-2020-12695
High 7.5
In plain English
A high-severity security flaw in the gssdp package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.2% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)15.2%top 3.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | gssdp | 1.0.5-1.el8 | ALSA-2021:1789 |
| AlmaLinux:8 | gssdp-devel | 1.0.5-1.el8 | ALSA-2021:1789 |
| AlmaLinux:8 | gssdp-docs | 1.0.5-1.el8 | ALSA-2021:1789 |
| AlmaLinux:8 | gupnp-devel | 1.0.6-1.el8 | ALSA-2021:1789 |
| Alpine:v3.20 | hostapd | 2.9-r2 | ALPINE-CVE-2020-12695 |
| Alpine:v3.21 | hostapd | 2.9-r2 | ALPINE-CVE-2020-12695 |
| Alpine:v3.22 | hostapd | 2.9-r2 | ALPINE-CVE-2020-12695 |
| Alpine:v3.23 | hostapd | 2.9-r2 | ALPINE-CVE-2020-12695 |
| Alpine:v3.24 | hostapd | 2.9-r2 | ALPINE-CVE-2020-12695 |
| Alpine:v3.20 | minidlna | 1.2.1-r2 | ALPINE-CVE-2020-12695 |
| Alpine:v3.21 | minidlna | 1.2.1-r2 | ALPINE-CVE-2020-12695 |
| Alpine:v3.22 | minidlna | 1.2.1-r2 | ALPINE-CVE-2020-12695 |
| Alpine:v3.23 | minidlna | 1.2.1-r2 | ALPINE-CVE-2020-12695 |
| Alpine:v3.24 | minidlna | 1.2.1-r2 | ALPINE-CVE-2020-12695 |
| Debian:12 | gupnp | 1.2.3-1 | DEBIAN-CVE-2020-12695 |
| Debian:13 | gupnp | 1.2.3-1 | DEBIAN-CVE-2020-12695 |
| Debian:14 | gupnp | 1.2.3-1 | DEBIAN-CVE-2020-12695 |
| Debian:12 | minidlna | 1.2.1+dfsg-3 | DEBIAN-CVE-2020-12695 |
| Debian:13 | minidlna | 1.2.1+dfsg-3 | DEBIAN-CVE-2020-12695 |
| Debian:14 | minidlna | 1.2.1+dfsg-3 | DEBIAN-CVE-2020-12695 |
| Debian:12 | pupnp-1.8 | no fix listed | DEBIAN-CVE-2020-12695 |
| Debian:12 | wpa | 2:2.9.0-16 | DEBIAN-CVE-2020-12695 |
| Debian:13 | wpa | 2:2.9.0-16 | DEBIAN-CVE-2020-12695 |
| Debian:14 | wpa | 2:2.9.0-16 | DEBIAN-CVE-2020-12695 |
| Rocky Linux:8 | gssdp | 0:1.0.5-1.el8 | RLSA-2021:1789 |
| Ubuntu:22.04:LTS | pupnp-1.8 | no fix listed | UBUNTU-CVE-2020-12695 |
Affected products (as reported)
References
- https://www.callstranger.com x_refsource_MISC
- https://www.kb.cert.org/vuls/id/339275 x_refsource_MISC
- [oss-security] 20200608 hostapd: UPnP SUBSCRIBE misbehavior in hostapd WPS AP mailing-list, x_refsource_MLIST
- https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of x_refsource_MISC
- https://github.com/yunuscadirci/CallStranger x_refsource_MISC
- http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html x_refsource_MISC
- https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek/ x_refsource_MISC
- https://github.com/corelight/callstranger-detector x_refsource_MISC
- FEDORA-2020-df3e1cfde9 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-1f7fc0d0c9 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-e538e3e526 vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20200806 [SECURITY] [DLA 2315-1] gupnp security update mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20200808 [SECURITY] [DLA 2318-1] wpa security update mailing-list, x_refsource_MLIST
- USN-4494-1 vendor-advisory, x_refsource_UBUNTU
- DSA-4806 vendor-advisory, x_refsource_DEBIAN
- [debian-lts-announce] 20201210 [SECURITY] [DLA 2489-1] minidlna security update mailing-list, x_refsource_MLIST
- DSA-4898 vendor-advisory, x_refsource_DEBIAN