The Microsoft UPnP (Universal Plug and Play) Vulnerability

by Paul Schmehl
Sept. 24, 2017 0 comments Symantec Pen Testing & Audits upn

On December 20, 2001, eEye Digital Security, the security firm that gave the Code Red worm its name, announced the discovery of “major security vulnerabilities”[1] in Microsoft’s flagship operating system, Windows XP. Specifically, the vulnerabilities were discovered in Microsoft’s Universal Plug and Play feature, which ships by default with XP. On that same day Microsoft released a patch [2] that resolved the issue; however, it was a dismal ending to a year that saw security flaws in Microsoft products announced in the press on a weekly basis [3] and exploited in hundreds of thousands of computers worldwide. This article will examine what UPnP is, what the Microsoft UPnP vulnerability is, how it can be exploited, what the impact on a network could be and what users should do to protect themselves.