CVE-2020-12695

High

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a…

mitre·CWE-276·Published 2020-06-08

CVSS

7.5

EPSS

0.15

KEV

Exploits

cve.orgen

254 chars

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

NVDen

254 chars

NVDes

294 chars

La especificación UPnP de Open Connectivity Foundation antes del 17-04-2020 no prohíbe la aceptación de una petición de suscripción con una URL de entrega en un segmento de red diferente a la URL de suscripción de evento totalmente calificada, también se conoce como el problema de CallStranger

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	7.8	8.6	7.8	AV:N/AC:M/Au:N/C:P/I:N/A:C
3.1	Primary	NVD	7.5	2.2	4.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H