4000+ failed ssh logins from external IP

TrueNAS General
,
21

You seem to still not be getting my point.

With UPnP an inbound port might be opened without the consumer even knowing. That is fundamentally dangerous.

“Game foo says I have only NAT type X and I need to open port YZ on my router - how do I do that?” on the game foo forum is different even if the hypothetical consumer ist pretty clueless about networking in general. People will in general explain to them how to get it “working” but also what exactly that does.

No inside or outside device should be able to open inbound connections on any firewall ever. Permitting inbound should always be an explicit admin action. Yes, even for SOHO.

2 Likes
22

But how exactly?

I’ve asked people many times for an example of UPnP (IGD) being the cause of hacking. They never answered. The only example I’ve been able to google myself is a 15-20-year-old case of playing Rickroll (or something like this) on media players, and the cause was a misconfig of UPnP in the router firmware, not with UPnP itself.

Does UPnP enlarge attack surface? Yes, a tiny bit. Lessens in some cases. But that’s about it.

23

It’s INTRANSPARENT! The User doesn’t know. That’s bad practise whether someone has been successfully hacked or not.

Good grief.

Systems opening channels outside of explicit admin control - bad. Bad bad bad.

I’m done here.

5 Likes
24

As per Grok - and assume most consumer routers do not have the latest updated version for anything…

https://grok.com/share/c2hhcmQtNA%3D%3D_c66e2f0a-b4ec-446a-a6fa-bc04b6843daa

Universal Plug and Play (UPnP) is a set of networking protocols that allows devices to discover each other and establish communication for data sharing, media streaming, and other services without manual configuration. While convenient, UPnP poses significant security risks, which often outweigh its benefits in many environments. Below are the key security risks associated with UPnP and reasons why it should be disabled:

Security Risks of UPnP

  1. Automatic Port Forwarding Without Oversight

    • UPnP allows devices to automatically open ports on a router to enable external communication. Malicious devices or malware-infected devices on the network can exploit this to open ports without user knowledge, exposing the network to external attacks.
    • For example, malware could use UPnP to create backdoors, allowing remote access to devices or the network.

  2. Lack of Authentication

    • UPnP does not require strong authentication for devices requesting network changes. Any device on the local network, including compromised or untrusted devices (e.g., a guest’s smartphone or IoT device), can issue UPnP commands.
    • This makes it easy for attackers to manipulate network settings if they gain access to the local network.

  3. Vulnerability to Exploits

    • Many UPnP implementations have known vulnerabilities due to poor coding practices or outdated software. For instance, flaws in UPnP libraries like MiniUPnP or Intel UPnP SDK have been exploited to execute arbitrary code or bypass firewall rules.
    • Historical examples include the 2013 UPnP vulnerabilities that exposed millions of routers to remote attacks, allowing attackers to reconfigure devices or extract sensitive data.

  4. Exposure to External Attacks

    • If UPnP is enabled on a router with a public-facing interface, attackers can send malicious UPnP requests from the internet to reconfigure the router, open ports, or redirect traffic. This is particularly dangerous if the router’s UPnP service is improperly configured to respond to external requests.
    • For example, vulnerabilities like those exploited in the “Misfortune Cookie” attack (2014) allowed attackers to manipulate UPnP-enabled devices remotely.

  5. Amplification in DDoS Attacks

    • UPnP can be abused in Distributed Denial of Service (DDoS) attacks. Attackers can send small UPnP requests to devices, which respond with significantly larger packets, amplifying the attack traffic. This was seen in UPnP-based reflection attacks targeting vulnerable routers.

  6. IoT Device Risks

    • Many Internet of Things (IoT) devices rely on UPnP for connectivity but lack robust security. Compromised IoT devices (e.g., smart cameras, thermostats) can use UPnP to expose themselves or other devices to the internet, creating entry points for attackers.

Why UPnP Should Be Disabled

  1. Reduces Attack Surface

    • Disabling UPnP prevents automatic port forwarding, ensuring that only manually configured ports are open. This gives users full control over which services are accessible from the internet, reducing the risk of unauthorized access.

  2. Mitigates Malware Risks

    • By disabling UPnP, malware on the local network cannot easily open ports or reconfigure the router, limiting its ability to communicate with external command-and-control servers or expose devices to attacks.

  3. Prevents Unintended External Exposure

    • Disabling UPnP ensures that devices are not inadvertently exposed to the internet due to misconfigured or vulnerable UPnP implementations, protecting sensitive data and services.

  4. Encourages Secure Manual Configuration

    • Manual port forwarding and network configuration require users to explicitly define which devices and services are accessible. While less convenient, this approach ensures greater oversight and security.

  5. Protects Against Known Vulnerabilities

    • Many routers and devices still run outdated UPnP software with unpatched vulnerabilities. Disabling UPnP eliminates the risk of exploits targeting these weaknesses.

  6. Safeguards IoT Environments

    • In networks with many IoT devices, disabling UPnP reduces the likelihood of compromised devices opening unauthorized ports or exposing the network to external threats.

When UPnP Might Be Acceptable

In low-risk environments, such as a home network with trusted devices and minimal external exposure, UPnP can be left enabled for convenience (e.g., for gaming or media streaming). However, even in these cases, precautions should be taken:

  • Ensure the router’s firmware is up to date.
  • Use strong network passwords and WPA3 encryption for Wi-Fi.
  • Segment IoT devices on a separate network or VLAN to limit their access.
  • Regularly monitor open ports using tools like ShieldsUP or network scanners.

How to Disable UPnP

  • Access your router’s web interface (usually via 192.168.0.1 or 192.168.1.1 in a browser).
  • Log in with admin credentials.
  • Navigate to the UPnP settings (often under “Advanced,” “NAT,” or “Port Forwarding”).
  • Disable the UPnP option and save changes.
  • Verify that no unexpected ports are open using a port-scanning tool.

Conclusion

UPnP’s convenience comes at the cost of significant security risks, including unauthorized port forwarding, lack of authentication, and exposure to exploits. Disabling UPnP is strongly recommended, especially in environments with untrusted devices or critical data. Manual configuration, while less convenient, provides better control and significantly enhances network security. If you must use UPnP, ensure your router and devices are fully patched and monitored regularly.

If you need help checking your router’s UPnP status or analyzing specific risks (e.g., via a network scan or device profile), let me know!

25

Known exploits

https://grok.com/share/c2hhcmQtNA%3D%3D_6c49115b-52b2-48fd-809c-eb8cf4776f9b

Known Active UPnP Exploits as of September 24, 2025

Universal Plug and Play (UPnP) continues to be a vector for exploitation due to its widespread use in routers, IoT devices, and software libraries, often with outdated or unpatched implementations. While many historical vulnerabilities (e.g., CVE-2020-12695 “CallStranger” for DDoS amplification) persist in legacy systems, recent exploits in 2025 focus on buffer overflows, privilege escalations, and code injection. These are considered “active” if they have public proof-of-concept (PoC) code, confirmed in-the-wild abuse, or unpatched devices exposed online.

Based on current threat intelligence, here are the most notable known UPnP exploits actively discussed or exploited in 2025. I’ve prioritized those with recent CVEs, confirmed impacts, and public exploits. Exploitation often requires network adjacency or exposure, but IoT proliferation amplifies risks.

Key Active Exploits

Exploit/CVE Description Impact Status & Evidence Affected Products
CVE-2025-48821
(Windows UPnP Device Host Use-After-Free)		 A use-after-free flaw in the UPnP Device Host service (upnphost.dll) allows attackers on adjacent networks to send crafted UPnP discovery packets, leading to memory corruption and privilege escalation. No authentication needed; exploits inherent local network trust. High: Privilege escalation (local to SYSTEM), potential RCE on Windows systems. CVSS: 8.1 (AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Patched in July 2025 Microsoft updates (e.g., Windows 10/11, Server 2016+). No public in-the-wild exploits confirmed yet, but similar historical UPnP flaws (e.g., CVE-2019-1405) were abused. Actively scanned for by threat actors. Windows 10 (21H2+), Windows 11 (22H2+), Windows Server 2016/2019/2022/2025.
CVE-2025-25427
(TP-Link WR841N Stored XSS via UPnP)		 Stored cross-site scripting (XSS) in the UPnP page (upnp.htm) allows remote attackers to inject malicious JavaScript via port mapping descriptions. Executes when the admin loads the page, enabling credential theft or session hijacking. Medium-High: Admin credential theft, potential RCE via further chaining. CVSS: 8.6. Public PoC available on GitHub. Disclosed April 2025; TP-Link advisory issued, but 1.5M+ vulnerable devices exposed online (via ZoomEye scans). Exploit code public; no confirmed mass abuse, but targeted attacks likely. TP-Link WR841N routers (firmware ≤4.19).
CVE-2025-7911
(D-Link DI-8100 Stack Buffer Overflow)		 Stack-based buffer overflow in the sprintf function of /upnp_ctrl.asp (jhttpd component) via manipulated “remove_ext_proto/remove_ext_port” arguments. Allows remote code execution without auth. Critical: RCE on exposed routers. CVSS: 9.8. Disclosed July 2025; public exploit disclosed. Vendor unresponsive; actively exploitable on unpatched devices. D-Link DI-8100 (firmware 1.0).
CVE-2025-6752
(Linksys Routers UPnP Layer3Forwarding Overflow)		 Stack-based buffer overflow in the UPnP Layer3Forwarding service, enabling remote code injection via crafted packets. High: RCE on home routers. CVSS: 7.5+. Disclosed June 2025; PoC available. Limited patching; exposed in home networks. Linksys routers (various models using vulnerable UPnP stack).
Eternal Silence (UPnP NAT Injection Campaign) Ongoing campaign abusing UPnP vulnerabilities (e.g., in MiniUPnP and Portable UPnP SDK) to inject malicious port mappings, exposing internal services (e.g., RDP, SMB) for further exploits like ransomware. Affects ~45,000+ devices. High: Backdoor creation, lateral movement, DDoS amplification. Active since 2022; 2025 scans show 277,000 vulnerable devices (out of 3.5M scanned), with confirmed injections. No specific CVE, but tied to unpatched libs (e.g., MiniUPnP <2.0). Routers/appliances using vulnerable UPnP libs (e.g., Netgear, older Cisco).
Flash UPnP Attacks Malicious SWF files exploit UPnP to force routers to open ports to attacker-controlled servers, bypassing firewalls. Often chained with NAT traversal flaws. Medium: Port exposure, data exfiltration. Persistently active in 2025 phishing kits; no CVE, but documented in threat reports. Affects browsers with Flash legacy support. Any UPnP-enabled router with internet-facing services.
Pinkslipbot/Qakbot Malware (UPnP Abuse) Banking Trojan exploits UPnP for port forwarding to hide C2 communications and proxy traffic. Infected devices become part of botnets. High: Persistent infection, proxying for DDoS/ransomware. Active in 2025 campaigns; FBI warnings renewed. Exploits unpatched routers for initial spread. Windows/IoT devices with UPnP; tied to older CVEs like CVE-2014-8361 (Realtek SDK).

Trends and Broader Context

  • Persistence of Legacy Issues: Older exploits like those in Portable UPnP SDK (CVE-2012-5958, buffer overflow via UDP) and MiniUPnP (CVE-2013-0229, DoS) remain active due to ~23M exposed IPs (per 2023-2025 scans). These enable RCE with a single packet and are bundled in Metasploit modules.
  • IoT and Router Focus: 2025 sees a surge in router-specific flaws (e.g., Netgear WNR854T UPnP daemon chains: auth bypass + buffer overflow + command injection for root shells). End-of-life hardware exacerbates risks.
  • In-the-Wild Activity: CISA’s Known Exploited Vulnerabilities Catalog doesn’t list new UPnP entries for 2025, but campaigns like Eternal Silence confirm real-world abuse. Rapid7 reports millions of devices vulnerable to amplification DDoS via UPnP.
  • Mitigation Recommendations:
    • Disable UPnP: On routers (via admin panel) and devices; use manual port forwarding.
    • Patch Immediately: Apply vendor updates (e.g., Microsoft July 2025, TP-Link firmware >4.19).
    • Scan Networks: Use tools like UPnP Inspector or ShieldsUP! to detect exposed services.
    • Segment IoT: Isolate devices on VLANs; monitor with NTA tools for anomalous UPnP traffic.
    • Firmware Vigilance: Avoid EOL devices; check NIST CVE list for UPnP entries (158+ total).

These exploits highlight UPnP’s design flaws (no auth, auto-port opening). For deeper analysis on a specific CVE or device, provide details!

26

@Poptop
Did you get your router NAT setup? It is an easy thing to do if you can access the internet and do a search for your router model and how to set up NAT/Firewall.

I can see this as being true since most consumers are sold a product and told to plug it in and it will work. They are not informed about updates and routine maintenance.

1 Like
27

Maintenance … :joy:

3 Likes
28

Precisely, and even those like Asus and others not using auto updates either by default, people get it with what ever it shipped with and don’t touch it for years!

29

Mine is a nice Asus router, but it runs Merlin. Merlin is basically the Asus software, with some tweaks. Advanced tweaks but the GUI is basically the same, it run very well and stable. No complaints at all.

30

I didn’t read the entire AI-generated bullshit. Some scenarios assume the malware is already inside the LAN. Some aren’t even related to IGD. Some mentioned misconf of UPnP in routers’ firmware.

Let’s not make this topic an AI battle. If you want to discuss a particular case, bring it and we will.

2 Likes
31

If I wanted to read a load of waffle from a LLM, I’m quite capable of asking it myself. Not that I would as I prefer to rely on my own knowledge instead of farming out questions to a text generator hardly known for its accuracy.

Please, don’t post LLM slop in answer to other people’s questions. If you don’t know enough yourself to comment, resist the temptation to pollute the forum with information which seems plausible but has no guarantee of correctness.

5 Likes
32

Thank you, @unseen. It’s offtopic, but I would highly recommend to forbid posting AI generated content in the community. It should only be permitted for people who are using automated translation tools to work around not being that fluent in English. The use of a translation tool could be marked in either the user’s profile or the first post in a thread where it’s used. (I’d recommend dedicated translation tools, not generic text generators/LLMs, as well.)

2 Likes
33

They are posted in the “AI Garbage” you do not wish to read.

And are all legit cases and reasons not to use UPnP unless you yourself can be sure it is properly secured, up to date standards and such, which you can not if you are using any OEM router…(Asus/ISP et cetera)

Included are the CVE’s, just some that have been reported, which are also accurate. To discredit all LLM’s due to the known flaws they have and just note they are never right is a little short sighted, especially when it is someone who works in the industry (me) and reads over the responses first before just posting,

Here you go…
https://www.cve.org/CVERecord/SearchResults?query=upnp

34

I work in the industry, IT and Cyber and read everything it noted before posting to confirm it is accurate, which it is.

That is called using a tool to assist you to save time…versus me sitting here spending 15 mins typing it all out myself because someone else thinks UPnP is fine to have enabled… telling me they have not done their recent research into said topic and the reasoning against it and active exploits out in the wild.

35

I’ve read some of them. And even investigated one of them. They all had the issues I mentioned above. I’ve spent like 10 minutes. I don’t want to spend more of my time when you literally can generate the wall of text in seconds. Not a fair and square discussion IMO. Thus, it only will lead to an AI battle. And I don’t want to participate in a rat race.

Do they all contradict the arguments I brought before? I mean, can I arbitrarily choose one of them and prove that it doesn’t stand?

Or will you pick the one? You said that you’ve read them all, so you should know the scariest one.

36

All of the above counter your points.

UPnP in general in SOHO / home/ ISP routers is not secure to trust it, as recent as June 2025 for Linksys. Remotely executable, do not need any infection with in the LAN side already.

The main point is, if you want to open something up to your network, manually do it as @pmh noted, you then at least have insight into what is coming into / out of your network versus trusting software to do what is best and most secure for your systems…as we know most software these days has little to no concern about security or using secure code. Tie that with most home users do not update their routers if they own their own and how quick as ISP’s to patch their provided routers…

Examples:

Linksys
https://www.cve.org/CVERecord?id=CVE-2025-6752

A vulnerability has been found in Linksys WRT1900ACS, EA7200, EA7450 and EA7500 up to 20250619 and classified as critical. This vulnerability affects the function SetDefaultConnectionService of the file /upnp/control/Layer3Forwarding of the component IGD. The manipulation of the argument NewDefaultConnectionService leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

TP-Link
https://nvd.nist.gov/vuln/detail/CVE-2025-25427

A stored cross-site scripting (XSS) vulnerability in the upnp.htm page of the web Interface in TP-Link WR841N v14/v14.6/v14.8 <= Build 241230 Rel. 50788n allows remote attackers to inject arbitrary JavaScript code via the port mapping description. This leads to an execution of the JavaScript payload when the upnp page is loaded.

D-Link
https://nvd.nist.gov/vuln/detail/CVE-2025-2360

A vulnerability classified as critical was found in D-Link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is the function SetUpnpSettings of the file /HNAP1/ of the component UPnP Service. The manipulation of the argument SOAPAction leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.

NIST
https://nvd.nist.gov/vuln/search#/nvd/home?keyword=UPnP&resultType=records

37

That is the one I was investigating. AIUI, “remotely” in this context means that the code doesn’t need to be run on the router itself. If you look at the POC code, it uses a local IP. Ok, mb, it was done for the security researcher’s convenience. But then we see /upnp/control/Layer3Forwarding which is a URL of the UPnP service. But UPnP doesn’t listen on the WAN interface… So, IMO, it requires LAN access.

Same thing.

Same thing. FWIW, it is also stated that it affects already non-supported models.

Yeah, go and find one!

So we are back to this:

38

No, it isn’t. You’re certainly not saving my time. I will thank you for clearly marking the posts as LLM slop, but these things are inherently untrustworthy. If I was to place any trust in what you copy-pasted, I’d have to fact check the LLM’s output myself.

I fail to see how this saves me time, or anyone else.

I think most people in this thread, apart from swc-phil, already understand that allowing programs inside your network to punch Internet wide holes in your firewall at their whim is a really bad idea.

4 Likes
39

I’m not OP, and I don’t see how this is really bad. I see that “disable UPnP ASAP!!1” became a frigging cult.

40

I corrected my post.

I won’t argue the point with you. Others have tried and failed.