UPnP.Web.Access.Via.Adobe.Flash.Plugin

Description

This indicates an attempt to exploit a vulnerability present in many network devices containing implementations of UPnP.
Many network devices listen for UPnP requests on local interfaces. By using browser plugins that execute in the context of the local system, an attacker may be able to send UPnP messages to local devices without authentication. As a result it may be possible to change the configuration of these devices. In many vendors' devices UPnP is enabled by default.

Affected Products

Many network devices are vulnerable.

Impact

System Compromise: remote attackers can gain control of vulnerable devices.

Recommended Actions

UPnP should be disabled on devices.

References