CVE-2012-5960
portable SDK for UPnP Devices < 1.6.18 - Stack-based Buffer Overflow via UDN Field in UDP Packet
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-5960. PoCs published by finn79426.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2012-5960, a denial-of-service (DoS) vulnerability in libupnp 1.6.13. The exploit sends a malformed SSDP M-SEARCH request with an overly long UUID field to trigger a buffer overflow, causing the target service to crash.
Description
Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a long UDN (aka upnp:rootdevice) field in a UDP packet.
Exploits (2)
This repository contains a proof-of-concept exploit for CVE-2012-5960, a denial-of-service (DoS) vulnerability in libupnp 1.6.13. The exploit sends a malformed SSDP M-SEARCH request with an overly long UUID field to trigger a buffer overflow, causing the target service to crash.
This Metasploit module exploits a buffer overflow in the `unique_service_name()` function of libupnp's SSDP processor, allowing remote code execution on vulnerable devices. It stages the payload via a secondary TCP connection due to size limitations.