CVE-2026-107159 in miniupnpd
Summary
by MITRE • 10/07/2026
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in MiniUPnPd versions through 2.3.11 represents a critical denial-of-service flaw rooted in improper input validation within the Simple Service Discovery Protocol processing logic. Specifically, the defect resides in the ProcessSSDPData function where the application fails to adequately check for zero values before performing arithmetic operations involving the MX header field of SSDP M-SEARCH messages. This divide-by-zero error occurs when an attacker crafts a specific multicast datagram containing an MX value set to 0 alongside a known Service Type, which is then directed at port 1900 on the target system running the vulnerable daemon. The presence of the --strict compilation flag in certain builds does not prevent this issue because the validation logic for network inputs remains insufficiently robust against malformed or maliciously crafted packets that exploit edge cases in the parsing routine.
From a technical perspective, the core flaw is classified under CWE-369, which denotes Divide By Zero errors. This type of vulnerability arises when software performs an arithmetic division operation without verifying that the divisor is non-zero. In the context of MiniUPnPd, the daemon processes incoming SSDP messages to manage device discovery and control within local networks. When a packet with MX: 0 is received, the internal calculation triggers a floating-point exception or integer overflow depending on the implementation details, resulting in an immediate termination signal such as SIGFPE sent by the operating system kernel to the process. This causes the MiniUPnPd daemon to crash unexpectedly and terminate its execution without graceful recovery mechanisms being triggered automatically.
The operational impact of this vulnerability is significant for any network relying on UPnP Internet Gateway Device services for automatic port forwarding or configuration management. Since the attack requires no authentication, it can be executed by any host connected to the same local area network segment as the vulnerable device. An attacker simply needs to send a single multicast packet to exploit the flaw, leading to an immediate denial of service condition where the UPnP IGD becomes unavailable. This disruption affects all devices and applications that depend on dynamic port mapping or remote access configurations provided by the gateway router running MiniUPnPd. The simplicity of the attack vector makes it particularly dangerous in environments with untrusted local network segments or compromised internal hosts, as even a single malicious packet can disrupt critical networking infrastructure services.
Mitigation strategies primarily involve upgrading to a patched version of MiniUPnPd where this division check has been implemented and validated against edge cases like zero values. Until an update is applied, administrators should consider restricting access to port 1900 using firewall rules that limit SSDP traffic to trusted sources only or disabling UPnP services entirely if they are not required for network operations. Additionally, deploying intrusion detection systems capable of identifying anomalous multicast patterns with specific header anomalies can provide a layer of defense against exploitation attempts. This vulnerability aligns with ATT&CK technique T1498 Network Denial of Service, specifically reflecting the sub-technique related to flooding or exploiting protocol weaknesses to disrupt availability rather than overwhelming bandwidth resources directly.