All add-ons that use SAX or JAXB parsing of externally received XML are potentially subject to this kind of attack. Responses to SSDP requests can be especially malicious. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity (XXE) attack allows attackers in the same network as the openHAB instance to retrieve internal information like the content of files from the file system. OpenHAB is a vendor and technology agnostic open source automation software for your home. An attacker can leverage this vulnerability to execute code in the context of root. A crafted MX header field in an SSDP message can trigger an overflow of a fixed-length stack-based buffer.

The specific flaw exists within the upnpd service, which listens on UDP port 1900 by default.

Authentication is not required to exploit this vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400 and R6700 firmware version 1.0.4.98 routers. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet. Universal Plug and Play (UPnP) is enabled by default on port 1900. ** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Windows SSDP Service Elevation of Privilege Vulnerability The server is vulnerable to a heap buffer overflow that is present due to unsafe crafting of SSDP NOTIFY messages from received M-SEARCH messages ST header. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. Successful exploitation of this vulnerability allows remote unauthenticated attackers to gain arbitrary code execution on the affected device. The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header.

Universal media server roku retrieving