Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

miniupnpd can crash from malformed SOAP requests

CVE-2013-1462 · published 13 years ago
Summary

The MiniUPnP daemon (miniupnpd version 1.0) that helps devices discover each other on your network can stop working if it receives a specially crafted request that is missing a double‑quote character. This can cause a loss of network functionality for any devices that rely on UPnP. Install the latest update or apply the vendor’s patch to keep the service running.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
miniupnp_project miniupnpd 1.0
cpe:2.3:a:miniupnp_project:miniupnpd:1.0:*:*:*:*:*:*:*
Original advisory text
Integer signedness error in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to cause a denial of service (incorrect me...
Integer signedness error in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to cause a denial of service (incorrect memory copy) via a SOAPAction header that lacks a " (double quote) character, a different vulnerability than CVE-2013-0230.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-189Numeric Errors
Timeline
Published31 Jan 2013
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2013-1462 · NVD
Track software like this
Free during beta