CVE-2019-12780: Belkin Wemo Crock-Pot UPnP API command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a CVSS of 9.8 and a very high EPSS score, plus a public exploit, makes this an urgent fix despite no KEV listing.

What it is

The Belkin Wemo-enabled Crock-Pot exposes a UPnP API whose SetSmartDevInfo action passes the SmartDevURL argument into a command without sanitization, allowing OS command injection. Because the endpoint is reachable over the network with no authentication, any host that can reach the device can run arbitrary commands on it.

Impact

An attacker gains arbitrary command execution on the appliance with the privileges of the UPnP service, enabling full device compromise and use as a foothold into the local network. No confidentiality, integrity or availability limit is implied by the CVSS vector.

Attack surface

Reached over the network by sending a POST request to /upnp/control/basicevent1 on the device's UPnP control endpoint. The CVSS vector shows no privileges required and no user interaction, so the request can be sent directly by any host that can route to the device.

Exploitation

A public exploit exists (Exploit-DB 46436) and EPSS is very high at 0.72 (99.4th percentile), indicating likely exploitation activity, though the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Apply the vendor firmware update for the affected Wemo-enabled Crock-Pot; if no fix is available, remove the device from the network or power it off.
• Isolate IoT appliances such as this on a separate VLAN or guest network with no access to internal hosts.
• Block inbound access to UPnP control ports (including the /upnp/control/basicevent1 endpoint) at network boundaries and disable UPnP on the router where possible.
• Restrict management and UPnP traffic to trusted hosts only, and monitor for unexpected POST requests to UPnP control URLs.
• If the device cannot be patched or isolated, replace it with a model that does not expose an unauthenticated UPnP control API.

Detection

• Monitor network traffic for POST requests to /upnp/control/basicevent1, especially those containing SetSmartDevInfo or SmartDevURL parameters.
• Alert on outbound connections from IoT device IPs to unusual destinations or command-and-control infrastructure.
• Inspect UPnP SOAP requests for shell metacharacters or unexpected command strings in argument values.
• Baseline normal UPnP traffic from these appliances and flag deviations in request frequency or payload size.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.