Denial Of Service Vulnerability in MiniUPnP MiniUPnPd
CVE-2019-12109

7.5HIGH

Key Information:

Vendor

Miniupnp Project

Status
Miniupnpd
Vendor
CVE Published:
15 May 2019

What is CVE-2019-12109?

A Denial Of Service vulnerability exists in MiniUPnP MiniUPnPd versions up to 2.1. This flaw is caused by a NULL pointer dereference in the GetOutboundPinholeTimeout function found in upnpsoap.c. Attackers can exploit this vulnerability to crash the MiniUPnPd service, disrupting its operations and impacting network functionalities for users relying on this service.

References

https://www.vdoo.com/blog/security-issues-discovered-in-m...
x_refsource_MISC
https://github.com/miniupnp/miniupnp/commit/13585f15c7f7d...
x_refsource_MISC
https://github.com/miniupnp/miniupnp/commit/86030db849260...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.