CVE-2012-5961: Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in...

Security readout for executives and security teams

CVE-2012-5961 is a remote code execution flaw in the UPnP library used by some devices and operating systems. A specially long device identifier in an SSDP UDP packet can overflow a stack buffer. Business urgency depends on whether exposed products embed libupnp 1.3.1 or the portable SDK for UPnP Devices. Most likely exposure is UPnP/SSDP-enabled software, routers, gateways, appliances, or Linux distributions that bundled libupnp 1.3.1 or the portable SDK for UPnP Devices. The source bundle lists Cisco, Debian, Mandriva, Mageia, D-Link release notes, CERT, and Rapid7 references, but does not provide a complete product inventory. Prioritize discovery and remediation for network devices and systems exposing UPnP/SSDP beyond trusted local networks. This is an older vulnerability, but remote code execution in embedded networking components can remain relevant when firmware is unmanaged or legacy devices persist. Mitigation focus: Inventory devices and packages using libupnp or the portable SDK for UPnP Devices.; Apply vendor OS packages or firmware updates that address CVE-2012-5961.; Disable UPnP/SSDP where it is not operationally required..

Prepared

Jun 24, 2026, 11:46 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.