A vulnerability in UPnP suitable for amplifying DDoS attacks and scanning the internal network
Details have been disclosed about a vulnerability (CVE-2020-12695) in the UPnP protocol that allows traffic to be sent to arbitrary recipients using the standard operation 'SUBSCRIBE.' This vulnerability has been given the code name CallStranger. It can be used for data extraction from networks protected by data leak prevention (DLP) systems, for scanning ports of computers within the internal network, and to amplify DDoS attacks using millions of connected […]
