CVE-2020-12695

Katalog CVE

CVSS 7.5 · High EPSS 15,2%

Kerentanan Incorrect Default Permissions pada ui unifi controller, w1.fi hostapd +58 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

Rincian

Terbit di NVD

8 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions

EPSS (30 hari)

15,2% peluang dieksploitasi; lebih tinggi dari 96,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 219 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://www.kb.cert.org/vuls/id/339275 advisory pihak ketiga · pemerintah AS
• http://packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html advisory pihak ketiga · vdb entry
• http://www.openwall.com/lists/oss-security/2020/06/08/2 mailing list · advisory pihak ketiga
• https://corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek/ advisory pihak ketiga
• https://github.com/corelight/callstranger-detector advisory pihak ketiga
• https://github.com/yunuscadirci/CallStranger advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/08/msg00011.html advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/08/msg00013.html advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/12/msg00017.html advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3SHL4LOFGHJ3... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZDWHKGN3LMGS... mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQEYVY4D7LASH... mailing list · advisory pihak ketiga
• https://usn.ubuntu.com/4494-1/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4806 advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4898 advisory pihak ketiga
• https://www.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-bi... advisory pihak ketiga
• https://www.callstranger.com broken link