CVE-2020-12695

Vulnerability

CVE-2020-12695, known as CallStranger, is a vulnerability in the Universal Plug and Play (UPnP) protocol specification maintained by the Open Connectivity Foundation (OCF) [1][3]. The flaw resides in the SUBSCRIBE function, which allows a caller to request event notifications and specify a Callback header containing a delivery URL. The specification before 2020-04-17 does not require that this callback URL reside on the same network segment as the original subscription request [1][3]. This enables a server-side request forgery (SSRF)-like condition in billions of devices that implement the affected UPnP stack, including personal computers, networking equipment, game consoles, and IoT devices [1][3]. Versions of the UPnP specification prior to the 2020-04-17 update are affected [1][3].

Exploitation

An attacker can send a crafted HTTP SUBSCRIBE request to a vulnerable UPnP device, setting the Callback header to an arbitrary URL [1][3][4]. No authentication is required if the device exposes UPnP on a reachable network interface. The vulnerable device then sends an HTTP NOTIFY request to the attacker-supplied URL when the subscribed event occurs [4]. This allows the attacker to force the device to connect to any destination, regardless of network segmentation. Exploitation requires only network access to the UPnP endpoint; no user interaction is needed beyond the initial device configuration [4]. Proof-of-concept code is publicly available [1][2].

Impact

Successful exploitation yields three primary impacts [1][3][4]: 1. Data exfiltration – an attacker can encode sensitive data into the callback URL, causing the UPnP device to send that data to an external server, bypassing Data Loss Prevention (DLP) controls [1][4]. 2. Amplified DDoS – the attacker can reflect and amplify TCP traffic toward a victim by causing many UPnP devices to connect simultaneously to the target, overwhelming it [1][3]. 3. Internal port scanning – an internet-facing UPnP device can be used to scan internal network ports of other assets, revealing services behind firewalls [1][4].

The attacker effectively gains an SSRF primitive with the trust level and network position of the compromised device, which may be inside a protected network segment.

Mitigation

The OCF updated the UPnP specification on 2020-04-17 to reject subscription requests where the Callback URL does not match the network segment of the original request [1][3]. Device vendors must implement this updated specification in firmware updates. As a workaround, users can disable UPnP on firewalls and network devices, or block TCP port 2869 and other UPnP-related ports at the perimeter [4]. Network monitoring with Zeek or similar tools can detect anomalous SUBSCRIBE requests with mismatched callback hosts [4]. As of the publication date, the vulnerability is not listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog.

References

[1] GitHub - yunuscadirci/CallStranger: Vulnerability checker for Callstranger (CVE-2020-12695) [2] Packet Storm - CallStranger UPnP Vulnerability Checker [3] Tenable Blog - CVE-2020-12695: CallStranger Vulnerability in Universal Plug and Play (UPnP) [4] Corelight Blog - Detecting the CallStranger UPnP Vulnerability With Zeek