by SuperBonBon | ![]() |
UPNP security

Security problems > Devices security
Security problems
Some security problems have been found with some UPNP implementations ( guess who :o) ). Most of the security flaws are implementation independant and do not concern UPNPLib. However a DDOS attack can be acheived due to a protocol flaw. UPNPLib has been developped to do not allow ( or at least limit ) such kind of attacks. You can read more about it here. The official MS bug report is here and the security bulletin from the company that discovered the issue.
UPNPLib is not concerned with these flaws, future will tell if UPNPLib other security issues will be found.
Devices security
Another problem with UPNP is that there is no protocol built-in ACL to define who can access and send orders to UPNP devices.
UPNP forum came with a solution to fix this issue but unfortunatly we did not find devices compliant with this spec to integrate this ACL and security layer in the library. We hope we will be able to do it anytime soon with some other tools.
This means that this library will not work with devices implementing and using such security services.