Product:
Universal Plug and Play
Summary
Improper access control in Universal Plug and Play allows an authorized attacker to disclose information locally. This vulnerability can lead to significant confidentiality issues as sensitive information may be exposed. The attack complexity is low, making it easier for attackers to exploit.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-32214 |
Exploitation
To exploit this vulnerability, an attacker with local access can leverage the improper access control in the upnp.dll component. By executing specific commands or scripts, the attacker can gain unauthorized access to sensitive information stored within the system. Since the attack requires low privileges and no user interaction, it poses a considerable risk to affected systems.
Affected Products
- Universal Plug and Play: A network protocol that allows devices to discover and connect with each other seamlessly.
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Microsoft. Additionally, restricting local access to the affected systems and monitoring for unusual activities can help reduce the risk of exploitation.