PT-2021-18232 · Unknown+2 · Portable Sdk For Upnp Devices+2

Medoc92 + 1 · Published 2021-04-20 · Updated 2025-10-21 · CVE-2021-29462

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Portable SDK for UPnP Devices versions prior to 1.14.6

Description: The server part of pupnp (libupnp) is susceptible to DNS rebinding attacks due to its failure to check the value of the Host header. This issue can be mitigated by utilizing DNS resolvers that block DNS-rebinding attacks.

Recommendations: For versions prior to 1.14.6, update to version 1.14.6 or later to resolve the issue. As a temporary workaround, consider using DNS resolvers that block DNS-rebinding attacks to minimize the risk of exploitation.

Fix

Insufficient Verification of Data Authenticity

RCE

Weakness Enumeration

CWE-345

CWE-20

Related Identifiers

ALT-PU-2022-7682

CVE-2021-29462

GHSA-6HQQ-W3JQ-9FHG

MGASA-2021-0319

OPENSUSE-SU-2024:11006-1

Affected Products

Alt Linux

Debian

Portable Sdk For Upnp Devices

References · 14

• https://security-tracker.debian.org/tracker/CVE-2021-29462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29462 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-29462 · Security Note
• https://advisories.mageia.org/MGASA-2021-0319.html · Security Note
• https://ubuntu.com/security/CVE-2021-29462 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-29462 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-29462 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0319 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29462 · Vendor Advisory
• https://github.com/pupnp/pupnp/security/advisories/GHSA-6hqq-w3jq-9fhg · Note
• https://github.com/pupnp/pupnp/commit/21fd85815da7ed2578d0de7cac4c433008f0ecd4 · Note
• https://bugs.mageia.org/show_bug.cgi?id=28923 · Note
• https://openwall.com/lists/oss-security/2021/04/20/4 · Note
• http://openwall.com/lists/oss-security/2021/04/20/4 · Note