High severity7.5NVD Advisory· Published Jun 4, 2020· Updated Jun 17, 2026

CVE-2020-13848

Description

Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.

Affected products

Pupnp/libupnp
cpe:2.3:a:libupnp_project:libupnp:*:*:*:*:*:*:*:*
Range: <=1.12.1
Debian/linux
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Portable UPnP SDK/Portable UPnP SDKdescription
Portable SDK For Upnp Project/Portable SDK For Upnpllm-fuzzy
Range: <=1.12.1
Pupnp/Pupnpllm-fuzzy
Range: <=1.12.1
osv-coords2 versions
pkg:rpm/opensuse/libupnp&distro=openSUSE%20Leap%2015.1 pkg:rpm/suse/libupnp&distro=SUSE%20Package%20Hub%2015%20SP1
< 1.6.25-lp151.3.3.1+ 1 more
- (no CPE)range: < 1.6.25-lp151.3.3.1
- (no CPE)range: < 1.6.25-bp151.4.3.1

Patches

Vulnerability mechanics

References

github.com/pupnp/pupnp/commit/c805c1de1141cb22f74c0d94dd5664bda37398e0nvdPatchThird Party Advisory
github.com/pupnp/pupnp/issues/177nvdThird Party Advisory
lists.debian.org/debian-lts-announce/2020/06/msg00006.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-06/msg00030.htmlnvd
lists.opensuse.org/opensuse-security-announce/2020-06/msg00033.htmlnvd
lists.debian.org/debian-lts-announce/2021/03/msg00007.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000