Test your router to see if its vulnerable to the UPnP Exploit.

By +Warwagon
in Smart Home, Network & Security

 Share

Recommended Posts

Grand Master

+Warwagon MVC

Posted
  • MVC
Posted

As of recently it has been discovered that most routers expose UPnP to the outside world, which is not good at all. This allows attackers "from the internet" to open ports in your routers.

It is recommended you DISABLE UPnP in your router. Below is a test to see if your router is vulnerable. Steve Gibson, the creator of the very popular "Shields-up" which scans your IP for open ports in your router has recently added a test for the upnp vulnerability. Simply click the link then click the "proceed" button. You will then see a button for the UPnP test. Good luck!

The Test

https://www.grc.com/x/ne.dll?bh0bkyd2

  • MillionVoltss, Teebor, The Evil Overlord and 1 other
  • Like 4
Experienced

pes2013

Posted
Posted

It is recommended you DISABLE UPnP in your router.

No; It is recommened that you get a good router. I have UPnP on my router enabled and

THE EQUIPMENT AT THE TARGET IP ADDRESS

DID NOT RESPOND TO OUR UPnP PROBES!

So either I have a good router or the test sucks.

Mentor

ajua

Posted
Posted

It's only recommended to disable UPnP on your routers if they don't pass that test, which means they are exposing you to the outer world.

Just passed the test on three touters with UPnP enabled. Two of them are running DD-WRT.

post-203976-0-34939600-1359915937.png

Grand Master

trek

Posted
Posted

THE EQUIPMENT AT THE TARGET IP ADDRESS

DID NOT RESPOND TO OUR UPnP PROBES!

Why would you disable uPnP anyways? It allows internal hosts to dynamically open ports like XBL or PSN for gaming and voice. Without it you'd have to manually open every single port those services and similar ones use. Just keep your internal hosts clean.

Grand Master

LUTZIFER

Posted
Posted

THE EQUIPMENT AT THE TARGET IP ADDRESS

DID NOT RESPOND TO OUR UPnP PROBES!

Why would you disable uPnP anyways? It allows internal hosts to dynamically open ports like XBL or PSN for gaming and voice. Without it you'd have to manually open every single port those services and similar ones use. Just keep your internal hosts clean.

Yeah I agree with keeping uPnP enabled also.

I ran many different servers over the years, long time ago now, so I had many ports opened for access, and that site's port tests always showed me as being safe and secure.

All depends on what type of security you're running on your computers.

Grand Master

The_Decryptor Veteran

Posted
  • Veteran
Posted

There should be no issue with running UPnP/NAT-PMP on your router if it's properly configured, I knew mine would pass this test from the start since it exposes it's configuration in a good manner (It only allows hosts on the 192.168/16 subnet to create a forwarding rule, and said rule has to point at the host that requested it, otherwise it's rejected), and shows what ports are forwarded on what protocol.

Never mind the fact that the firewall should reject outside communication before it even gets to the UPnP/NAT-PMP daemon anyway, if it isn't being blocked you have bigger issues.

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

"Without it you'd have to manually open every single port those services and similar ones use."

So -- your talking a handful of ports at most.. UPnP is to allow unsolicted inbound traffic to get through your nat router. Traffic initiated by you, or in answer to your traffic is allowed.

Most people have no use of UPnP, it has been a nightmare since it was created -- who in their right mind thought, hey lets allow ports to be opened on your gateway/firewall without any sort of auth at all!!

And no UPnP should not be reachable via your public IP that is for damn sure.

Grand Master

spaceelf

Posted
Posted

I disable it anyway. The fact that UPnP, by design, lets any application communicate with the router and open ports should make any security conscious user uneasy.

If you trust what's in your network and have the routers firewall up I don't see how it could.

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

^ the point is UPnP can remove your firewall settings. Without even a nod to you that its doing so, nor any sort of auth method to allow it.

There really needs to be some form of notification and auth to the mechanism - and then sure it would be a valid tool in opening firewall ports for the masses.

Grand Master

xendrome

Posted
Posted

THE EQUIPMENT AT THE TARGET IP ADDRESS

DID NOT RESPOND TO OUR UPnP PROBES!

Why would you disable uPnP anyways? It allows internal hosts to dynamically open ports like XBL or PSN for gaming and voice. Without it you'd have to manually open every single port those services and similar ones use. Just keep your internal hosts clean.

It would allow any malicious program to actively contact your router, open whatever ports it wants, and then transmit data through those ports all without your knowledge.... pretty big security hole if you ask me.

Steve Gibson, the person who creates the most FUD on the internet with his crazy rants and observations!!!

I'm not going to argue that the fact that he is crazy, which he probably is, but he is also very smart. And Facts do not = FUD.

Are you up to date on this UPnP issue? The typical way UPnP works is, an active program on one of the systems on your network will contact the router and open ports for whatever program/service to pass data through. Sounds ok right, well there is an exploit on a TON of routers that allows that request to be made from the OUTSIDE over the WAN, so if you have one of these affected routers, anyone outside your network, can open up ports into your network using a little bit of packet "magic". It's a pretty big deal.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Bypassed Windows 11 shows surprising stability on ancient, completely unsupported hardware

      By hellowalkman · Posted

      Bypassed Windows 11 shows surprising stability on ancient, completely unsupported hardware by Sayan Sen When Windows 11 was first released, one of the most complained-about issues with the new desktop Microsoft OS was its higher system requirements, which pushed many relatively modern and powerful processors and devices onto the officially unsupported list. Thankfully, they have not been updated again for the base OS, though systems require four times the memory and storage if they want to run AI-powered apps and features. As such, Windows 11 technically runs on 4GB of memory, and there is no imposed restriction on the generation of memory it supports. Speaking of memory, prices are extremely high nowadays for hardware, especially DDR5 and DDR4 kits due to the current silicon shortage, and there are also reports of it affecting DDR2 as well, and it might only be a matter of time before even DDR1 gets affected. Before that could happen, an enthusiast took an ancient DDR1-based system and decided to try out Windows 11 on it to see how well the modern OS would fare on such hardware. The system runs an outdated graphics card interface standard based on AGP, or Advanced Graphics Port, called AGP 3.0 or AGP8x. AGP was essentially succeeded by the modern PCI Express (PCIe) bus standard. The user behind the experiment is retro hardware enthusiast Omores, who built the system around an ASRock ConRoe865PE motherboard based on Intel's i865PE chipset from way back in 2003, around the time when AGP was still in fashion. What made this board special back in the day was its unusual support for newer Core 2 Duo and even Core 2 Quad processors while still retaining older DDR1 memory support and an AGP8X graphics slot, making it an ideal bridge or link between two vastly different generations. Powering the machine was Intel's Core 2 Quad Q6600 alongside 3GB of DDR1 RAM and an ATI Radeon HD 4650 AGP graphics card, one of the final and most capable GPUs released for the aging AGP interface. While installing Windows 11 itself was relatively easy by bypassing Microsoft's hardware checks, getting the graphics card fully functional proved to be some challenge. Microsoft had quietly dropped native AGP support after the earliest releases of Windows 10, meaning newer versions of Windows no longer include the necessary Graphics Address Remapping Table (GART) drivers required for proper AGP acceleration. Without them, AGP graphics cards typically boot up, though with limited functionality, and can often throw a Code 43 error in Device Manager. To work around the limitation, Omores extracted Intel's legacy AGP440 SYS driver from an early Windows 10 release and paired it with a modified INF file so Windows 11 would correctly recognize the chipset. Following this and combined with AMD's final 64-bit Catalyst AGP drivers from 2012, the Radeon HD 4650 was able to operate with full AGP 8X acceleration intact. The result was said to be surprisingly usable for hardware that is over two decades old. Hardware-accelerated H.264 video playback worked correctly and benefited apps like Firefox, while legacy applications and games ran without major graphical issues. The system also successfully completed the 3DMark 2001 benchmark, although performance naturally lagged behind what the same hardware achieves under Windows 7, which is significantly lighter than Windows 11. There was, however, one unavoidable limitation as Microsoft's Windows 11 version 24H2 introduces a mandatory SSE4.2 CPU instruction requirement that cannot be bypassed through installer modifications or registry tweaks. Since no AGP-era processor supports SSE4.2, Windows 11 version 23H2 effectively becomes the final release capable of running on such systems. Regardless, it is still a very cool feat and quite fascinating to see just how stable Windows 11 turned out to be on such unfamiliar hardware. Source: Omores (Patreon) via O_MORES (Reddit)
    • Meta is reusing old DDR4 RAM in its servers instead of buying new hardware

      By +Good Bot, Bad Bot · Posted

      That will only really help other players that are also responsible for creating the problem.
    • Meta is reusing old DDR4 RAM in its servers instead of buying new hardware

      By Nick H. · Posted

      Well, it's good to know that they have found a workaround to a problem that they helped create, I guess...
    • Meta is reusing old DDR4 RAM in its servers instead of buying new hardware

      By Ivan Jenic · Posted

      Meta is reusing old DDR4 RAM in its servers instead of buying new hardware by Ivan Jenic Image: Meta The global hardware shortage isn’t exactly news, as the entire world has been struggling with rising component prices for quite some time now. And while big companies certainly aren’t as affected as the average consumer, even they aren’t opposed to the idea of saving a few (million) bucks. Meta appears to have found a way to spend less on new hardware while also putting its outdated infrastructure to use, essentially killing two birds with one stone. The company has built a custom chip that lets it reuse memory from retired servers rather than buying new hardware. The chip is called Vistara and allows for connecting old DDR4 RAM from obsolete servers into new servers that rely on DDR5. The problem Vistara solves goes back to a basic mismatch in how long hardware lasts. Meta replaces its servers every three to five years, but the memory modules inside them are good for seven to ten. When a server gets decommissioned, perfectly usable DDR4 RAM goes with it. Meta is presenting the new method at today’s ISCA symposium, but The Register has got hold of a paper that explains how Vistara works. It's a custom ASIC that bridges DDR4 memory to newer processors via aCXL 2.0/1.1 interface over PCIe Gen5 x16. Meta pulls DDR4 sticks from old machines and installs them in dedicated units it calls MemServers, each of which pairs 768GB of DDR5 with 256GB of recovered DDR4. The operating system sees the DDR4 as an additional memory node and draws from it when the primary DDR5 is running low. Off-the-shelf CXL hardware couldn't do this, so Meta built its own. Existing interfaces bundle their own memory with the controller, which makes reusing old RAM sticks impossible. But Vistara separates the controller from the memory entirely, so Meta can plug in whatever DDR4 sticks it has on hand. Meta plans to deploy the new architecture in hyperscale infrastructure with millions of servers, which should mean that Meta’s AI datacenters will now be more efficient. The company is investing heavily in AI infrastructure, especially with its new AI model, Muse Spark, now widely available. All of this doesn't mean that Meta will exclusively rely on "recycled" RAM, but the company is still looking at considerable savings at scale.
    • Save up to 87% on ChatPlayground AI lifetime subscriptions

      By News Staff · Posted

      Save up to 87% on ChatPlayground AI lifetime subscriptions by Steven Parker Today's highlighted deal comes via our Apps + Software section of the Neowin Deals store, where for only a limited time, you can save up to 87% on ChatPlayground AI: lifetime subscriptions. ChatPlayground AI puts the world’s top AI models in one powerful interface, letting you enter a single prompt and instantly compare outputs from multiple models to choose the perfect response for your needs. Boost productivity and creativity with access to the latest AI giants like GPT-4o, Claude Sonnet 4, Gemini 1.5 Flash, DeepSeek V3, and dozens more — all in one window. Whether you’re chatting, coding, generating images, or refining prompts, ChatPlayground AI equips you with advanced tools like prompt engineering, image/PDF chat, saved conversations, and AI image creation, plus priority support to keep your workflow seamless. Access the world’s best AI models Side-by-Side Comparisons: Enter one prompt & instantly view results from multiple AI models to find the best output for your needs 40+ AI Models: Includes GPT-4o, Claude Sonnet 4, Gemini 1.5 Flash, DeepSeek V3, Llama, Perplexity, and many more Multi-Function Platform: Access AI for chat, image generation & coding all within a single interface Web Browser Extension: Offers a Chrome extension to seamlessly integrate the platform into your browsing workflow Boost productivity with powerful features ChatPlayground Interface: Designed for seamless AI model comparison in one window Prompt Engineering: Refine & optimize your prompts for better, more accurate responses Chat with Images & PDFs: Upload visuals and documents to get context-aware answers Saved Chat History: Keep track of past conversations for reference & ongoing projects AI Image Generation: Create high-quality visuals powered by top AI image models Priority Customer Support: Get faster assistance whenever you need it What you'll get with the Unlimited Plan Includes unlimited messages/month Built for prompt engineers, startups, and teams who run experiments nonstop Includes priority access to new features and future models Good to know Length of access: lifetime Redemption deadline: redeem your code within 30 days of purchase Access options: Desktop Max number of device(s): Unlimited Available to both NEW & Existing users Updates included A lifetime subscription to ChatPlayground AI (Unlimited Plan) normally costs $619, but you can pick it up for just $79 for a limited time - that represents a saving of $530 (87% off). Click the link below for more details, always check terms and specifications before making a purchase. Get this ChatPlayground AI (Unlimited) for $79 (was $619) There are also two other discounted plans to choose from. Although priced in U.S. dollars, this deal is available for digital purchase worldwide. Support queries If you have queries or need support for any of the Neowin Deals, please use the contact form here. Neowin Deals are managed and sold by StackCommerce who represent Neowin on an affiliate basis. Why we post these deals We post these because we earn commission on each sale so as not to rely solely on advertising, which many of our readers block. It all helps toward paying staff reporters, servers and hosting costs. So for those that keep moaning and complaining, be thankful we're still online for you to even do that. Other ways to support Neowin Whitelist Neowin by not blocking our ads Create a free member account to see fewer ads Make a donation to support our day to day running costs Subscribe to Neowin - for $14 a year, or $28 a year for an ad-free experience Disclosure: Neowin benefits from revenue of each sale made through our branded deals site powered by StackCommerce.

  • Recent Achievements

    • Reacting Well
      NovaEdgeX earned a badge
      Reacting Well
    • Week One Done
      NovaEdgeX earned a badge
      Week One Done
    • One Year In
      BA the Curmudgeon earned a badge
      One Year In
    • Conversation Starter
      rosiecharles earned a badge
      Conversation Starter
    • First Post
      KMilenkoski1202 earned a badge
      First Post

  • Popular Contributors

    1. 1
      +primortal
      539
    2. 2
      +Edouard
      266
    3. 3
      PsYcHoKiLLa
      151
    4. 4
      Steven P.
      98
    5. 5
      macoman
      66
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!