ID: INFO-14

Title: UPnP service available and exposed on all network interfaces

Severity: Informational

CVSS Score: -

CVSS Vector String: -

Description: Universal Plug and Play (UPnP) is active on port 1900 and listening on all network interfaces, with additional UPnP endpoints exposed on ports 49152 and 49153. UPnP has a long history of serious vulnerabilities on consumer routers, including unauthenticated port forwarding manipulation and remote code execution. Exposure on all interfaces rather than LAN-only unnecessarily increases the attack surface.

Remediation: Restrict UPnP to the LAN interface only. If UPnP is not required, disable it entirely. Ensure the UPnP implementation is kept up to date.

More information: See System Hardening Analysis chapter.