CVE-2012-5960: Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in...

Security readout for executives and security teams

CVE-2012-5960 is a memory corruption flaw in libupnp, a UPnP software library used by devices and applications. A reachable UPnP/SSDP service using affected libupnp versions could be crashed or potentially taken over remotely. The bundle names libupnp before 1.6.18, but does not provide a complete affected product list. Exposure is likely where products, firmware, or applications include libupnp before 1.6.18 and expose UPnP/SSDP to untrusted networks. The provided CVE data does not enumerate affected vendors or products, so asset validation must focus on embedded library use and vendor advisories. Treat this as high priority for network-connected and embedded devices. Remote code execution in UPnP can affect perimeter, consumer, and infrastructure devices, but urgency depends on whether affected libupnp versions are present and reachable. Mitigation focus: Upgrade libupnp to 1.6.18 or a vendor-supported fixed build.; Apply relevant vendor firmware, OS, or package updates for UPnP components.; Disable UPnP/SSDP where it is not operationally required..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.