Vulnerability record · CVE-2013-0229 · published 31 January 2013
CVE-2013-0229: MiniUPnPd SSDP handler buffer over-read crashes service
MMiniupnp Project · Miniupnpd
The ProcessSSDPRequest function in minissdp.c in MiniUPnPd before 1.4 mishandles a crafted SSDP request, triggering a buffer over-read that crashes the daemon. Because MiniUPnPd is the UPnP Internet Gateway Device daemon on many routers and embedded devices, a crash can take down UPnP and related network services. The record gives no affected version list beyond 'before 1.4' and no patch reference.
Description
The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read.
AV:N/AC:L/Au:N/C:N/I:N/A:C
Automated analysis
high priorityUnauthenticated remote crash of a widely embedded UPnP daemon with very high EPSS, though no KEV listing or confirmed exploit reference.
What it is
The ProcessSSDPRequest function in minissdp.c in MiniUPnPd before 1.4 mishandles a crafted SSDP request, triggering a buffer over-read that crashes the daemon. Because MiniUPnPd is the UPnP Internet Gateway Device daemon on many routers and embedded devices, a crash can take down UPnP and related network services. The record gives no affected version list beyond 'before 1.4' and no patch reference.
Impact
An unauthenticated remote attacker can cause a denial of service by crashing the MiniUPnPd process, disrupting UPnP/NAT-PMP functionality on the device. No confidentiality or integrity impact is described; the CVSS vector rates availability as complete.
Attack surface
Reachable over the network via the SSDP handler, typically UDP port 1900 on the LAN or any interface where SSDP is exposed. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.764 probability, 99.5th percentile), suggesting active interest. Reference tags are empty, so no public exploit or PoC is confirmed by this record.
What to do
- Upgrade MiniUPnPd to version 1.4 or later, which the description states fixes the flaw.
- If UPnP is not needed, disable the MiniUPnPd service or block SSDP (UDP 1900) at network boundaries.
- Restrict SSDP exposure to trusted LAN segments and filter inbound UDP 1900 from untrusted networks.
- Monitor the daemon for unexpected restarts and add a supervisor/watchdog to limit outage duration.
- Check vendor firmware updates for embedded devices bundling MiniUPnPd, since the daemon is often shipped inside router firmware.
Detection
- Alert on MiniUPnPd process crashes or restarts, especially correlated with inbound SSDP traffic.
- Inspect UDP port 1900 traffic for malformed or oversized SSDP requests that deviate from normal M-SEARCH/ NOTIFY patterns.
- Baseline normal SSDP request sizes and flag anomalies that could trigger the over-read.
- Review device logs for repeated UPnP service failures following bursts of SSDP packets.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-0229 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-0229), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
