{"id":"CVE-2020-12695","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-12695","generatedAt":"2026-11-05T02:08:56.547Z","title":"The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.","description":"The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.","published":"2020-06-08T17:15:10.000Z","lastModified":"2026-06-17T02:52:09.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H"},"cwe":["CWE-276"],"affected":["ui/unifi controller","w1.fi/hostapd","asus/rt-n11","broadcom/adsl","canon/selphy cp1200","cisco/wap131","cisco/wap150","cisco/wap351","dlink/dvg-n5412sp","dell/b1165nfw","epson/ep-101","epson/ew-m970a3t","epson/m571t","epson/xp-100","epson/xp-2101","epson/xp-2105","epson/xp-241","epson/xp-320","epson/xp-330","epson/xp-340","epson/xp-4100","epson/xp-4105","epson/xp-440","epson/xp-620","epson/xp-630","epson/xp-702","epson/xp-8500","epson/xp-8600","epson/xp-960","epson/xp-970","hp/5020 z4a69a","hp/5030 m2u92b","hp/5030 z4a70a","hp/5034 z4a74a","hp/5660 f8b04a","hp/deskjet ink advantage 3456 a9t84c","hp/deskjet ink advantage 3545 a9t81a","hp/deskjet ink advantage 3545 a9t81c","hp/deskjet ink advantage 3545 a9t83b","hp/deskjet ink advantage 3546 a9t82a","hp/deskjet ink advantage 3548 a9t81b","hp/deskjet ink advantage 4515","hp/deskjet ink advantage 4518","hp/deskjet ink advantage 4535 f0v64a","hp/deskjet ink advantage 4535 f0v64b","hp/deskjet ink advantage 4535 f0v64c","hp/deskjet ink advantage 4536 f0v65a","hp/deskjet ink advantage 4538 f0v66b","hp/deskjet ink advantage 4675 f1h97a","hp/deskjet ink advantage 4675 f1h97b","hp/deskjet ink advantage 4675 f1h97c","hp/deskjet ink advantage 4676 f1h98a","hp/deskjet ink advantage 4678 f1h99b","hp/deskjet ink advantage 5575 g0v48b","hp/deskjet ink advantage 5575 g0v48c","hp/envy 100 cn517a","hp/envy 100 cn517b","hp/envy 100 cn517c","hp/envy 100 cn518a","hp/envy 100 cn519a"],"epss":{"score":0.15193,"percentile":0.96757,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 15.2%, higher than 97% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2020/06/08/2","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/corelight/callstranger-detector","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/yunuscadirci/CallStranger","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00011.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00017.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3SHL4LOFGHJ3DIXSUIQELGVBDJ7V7LB/","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZDWHKGN3LMGSUEOAAVAMOD3IUIPJVOJ/","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQEYVY4D7LASH6AI4WK3IK2QBFHHF3Q2/","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/4494-1/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.callstranger.com","tags":["Broken Link"],"source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2020/dsa-4806","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.debian.org/security/2021/dsa-4898","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.kb.cert.org/vuls/id/339275","tags":["Third Party Advisory","US Government Resource"],"source":"cve@mitre.org"},{"url":"https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2020/06/08/2","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/corelight/callstranger-detector","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/yunuscadirci/CallStranger","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00011.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00017.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3SHL4LOFGHJ3DIXSUIQELGVBDJ7V7LB/","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZDWHKGN3LMGSUEOAAVAMOD3IUIPJVOJ/","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQEYVY4D7LASH6AI4WK3IK2QBFHHF3Q2/","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/4494-1/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.callstranger.com","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2020/dsa-4806","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2021/dsa-4898","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.kb.cert.org/vuls/id/339275","tags":["Third Party Advisory","US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-12695","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}