Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2012-5964 Details

Description

Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) 1.3.1 allows remote attackers to execute arbitrary code via a long ServiceType (aka urn service) field in a UDP packet.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://pupnp.sourceforge.net/ChangeLog	CVE
https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play	CVE
https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf	CVE
https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb	CVE
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0037	CVE
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp	CVE
http://tsd.dlink.com.tw/temp/PMD/12879/DSR-500_500N_1000_1000N_A1_Release_Notes_FW_v1.08B77_WW.pdf	CVE
http://tsd.dlink.com.tw/temp/PMD/12960/DSR-150N_A2_Release_Notes_FW_v1.05B64_WW.pdf	CVE
http://tsd.dlink.com.tw/temp/PMD/12966/DSR-150_A1_A2_Release_Notes_FW_v1.08B44_WW.pdf	CVE
http://tsd.dlink.com.tw/temp/PMD/13039/DSR-250_250N_A1_A2_Release_Notes_FW_v1.08B44_WW_RU.pdf	CVE
http://www.debian.org/security/2013/dsa-2614	CVE
http://www.debian.org/security/2013/dsa-2615	CVE
http://www.kb.cert.org/vuls/id/922681	CVE	PatchUS Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2013:098	CVE
http://www.securityfocus.com/bid/57602	CVE	Exploit
http://pupnp.sourceforge.net/ChangeLog	[email protected]
https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play	[email protected]
https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf	[email protected]
https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb	[email protected]
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0037	[email protected]
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp	[email protected]
http://tsd.dlink.com.tw/temp/PMD/12879/DSR-500_500N_1000_1000N_A1_Release_Notes_FW_v1.08B77_WW.pdf	[email protected]
http://tsd.dlink.com.tw/temp/PMD/12960/DSR-150N_A2_Release_Notes_FW_v1.05B64_WW.pdf	[email protected]
http://tsd.dlink.com.tw/temp/PMD/12966/DSR-150_A1_A2_Release_Notes_FW_v1.08B44_WW.pdf	[email protected]
http://tsd.dlink.com.tw/temp/PMD/13039/DSR-250_250N_A1_A2_Release_Notes_FW_v1.08B44_WW_RU.pdf	[email protected]
http://www.debian.org/security/2013/dsa-2614	[email protected]
http://www.debian.org/security/2013/dsa-2615	[email protected]
http://www.kb.cert.org/vuls/id/922681	[email protected]	PatchUS Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2013:098	[email protected]
http://www.securityfocus.com/bid/57602	[email protected]	Exploit

see all 30 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-119	Improper Restriction of Operations within the Bounds of a Memory Buffer	[email protected]

Affected Products

Product	Versions
portable sdk for upnp project portable sdk for upnp	1.3.1
CPE cpe:2.3:a:portable_sdk_for_upnp_project:portable_sdk_for_upnp:1.3.1:::::::* Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 29, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Sep 1, 2015	Modified Analysis	[email protected]
May 14, 2015	CVE Modified	[email protected]
Feb 1, 2013	Initial Analysis	[email protected]