CVE-2012-5958
EXPLOITEDlibupnp < 1.6.18 - Remote Code Execution via SSDP Unique Service Name Parsing
Title source: llmExploitation Summary
CVE-2012-5958 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 5 public exploits from researchers including Patrik Lantz, lochiiconnectivity, hmrumman777-beep, including a Metasploit module exploits/multi/upnp/libupnp_ssdp_overflow.
AI-analyzed exploit summary This exploit triggers a stack-based buffer overflow in libupnp versions <= 1.6.6 by sending a maliciously crafted M-SEARCH SSDP packet with an oversized 'ST' header. The payload consists of 324 'A' characters followed by 'BBBB', designed to crash the service (DoS).
Description
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a UDP packet with a crafted string that is not properly handled after a certain pointer subtraction.
Exploits (5)
This exploit triggers a stack-based buffer overflow in libupnp versions <= 1.6.6 by sending a maliciously crafted M-SEARCH SSDP packet with an oversized 'ST' header. The payload consists of 324 'A' characters followed by 'BBBB', designed to crash the service (DoS).
This Perl script scans for UPnP devices vulnerable to CVE-2013-0229, CVE-2013-0230, CVE-2012-5958, and CVE-2012-5959 by sending an M-SEARCH request and analyzing the response for known vulnerable software versions.
The repository contains a reconnaissance tool for detecting vulnerable libupnp versions (CVE-2012-5958) via banner grabbing and XML fuzzing, but does not include functional exploit code for achieving RCE.
This Metasploit module exploits a buffer overflow in the `unique_service_name()` function of libupnp's SSDP processor, allowing remote code execution on vulnerable devices. It stages the payload over a secondary TCP connection due to size limitations.
This Metasploit module exploits a buffer overflow in the `unique_service_name()` function of libupnp's SSDP processor, allowing remote code execution on vulnerable devices. It stages the payload over a secondary TCP connection due to size limitations.