Executive brief
pupnp (also known as libupnp) is a software development kit used by developers to build Universal Plug and Play (UPnP) applications for smart devices and network controllers. A flaw in how the library handles web addresses allows a malicious device on the network to trick the software into connecting to unintended internal network ports. This could be used by an attacker to bypass security controls or probe internal services that should not be accessible.
Technical details
A vulnerability exists in the `parse_uri()` function within `upnp/src/genlib/net/uri/uri.c` due to an unsafe narrowing cast. The code uses `atoi()` to convert a port string to a signed integer and then casts it to an `unsigned short int` (uint16_t). Because the only validation check is for a zero value, an attacker can provide out-of-range port numbers (e.g., 65537) that truncate to a valid non-zero port (e.g., 1). This leads to SSRF port confusion, allowing an attacker to bypass port-based access controls or perform service fingerprinting. The issue is reachable via malformed LOCATION headers in SSDP M-SEARCH responses or rogue device descriptions. The vulnerability is fixed in version 1.18.5 by replacing `atoi()` with `strtol()` and implementing proper bounds checking (1-65535).
Affected products
- pupnp pupnp (libupnp) < 1.18.5
Timeline
- 2026-04-17: disclosed: Vulnerability discovered and reported to maintainers
- 2026-04-22: patched: Version 1.18.5 released with fix
- 2026-05-08: advisory: CVE-2026-41682 published