Test your router to see if its vulnerable to the UPnP Exploit.

By +Warwagon
in Smart Home, Network & Security

 Share

Recommended Posts

Grand Master

+Warwagon MVC

Posted
  • MVC
Posted

As of recently it has been discovered that most routers expose UPnP to the outside world, which is not good at all. This allows attackers "from the internet" to open ports in your routers.

It is recommended you DISABLE UPnP in your router. Below is a test to see if your router is vulnerable. Steve Gibson, the creator of the very popular "Shields-up" which scans your IP for open ports in your router has recently added a test for the upnp vulnerability. Simply click the link then click the "proceed" button. You will then see a button for the UPnP test. Good luck!

The Test

https://www.grc.com/x/ne.dll?bh0bkyd2

Experienced

pes2013

Posted
Posted

It is recommended you DISABLE UPnP in your router.

No; It is recommened that you get a good router. I have UPnP on my router enabled and

THE EQUIPMENT AT THE TARGET IP ADDRESS

DID NOT RESPOND TO OUR UPnP PROBES!

So either I have a good router or the test sucks.

Mentor

ajua

Posted
Posted

It's only recommended to disable UPnP on your routers if they don't pass that test, which means they are exposing you to the outer world.

Just passed the test on three touters with UPnP enabled. Two of them are running DD-WRT.

post-203976-0-34939600-1359915937.png

Grand Master

trek

Posted
Posted

THE EQUIPMENT AT THE TARGET IP ADDRESS

DID NOT RESPOND TO OUR UPnP PROBES!

Why would you disable uPnP anyways? It allows internal hosts to dynamically open ports like XBL or PSN for gaming and voice. Without it you'd have to manually open every single port those services and similar ones use. Just keep your internal hosts clean.

Grand Master

LUTZIFER

Posted
Posted

THE EQUIPMENT AT THE TARGET IP ADDRESS

DID NOT RESPOND TO OUR UPnP PROBES!

Why would you disable uPnP anyways? It allows internal hosts to dynamically open ports like XBL or PSN for gaming and voice. Without it you'd have to manually open every single port those services and similar ones use. Just keep your internal hosts clean.

Yeah I agree with keeping uPnP enabled also.

I ran many different servers over the years, long time ago now, so I had many ports opened for access, and that site's port tests always showed me as being safe and secure.

All depends on what type of security you're running on your computers.

Grand Master

The_Decryptor Veteran

Posted
  • Veteran
Posted

There should be no issue with running UPnP/NAT-PMP on your router if it's properly configured, I knew mine would pass this test from the start since it exposes it's configuration in a good manner (It only allows hosts on the 192.168/16 subnet to create a forwarding rule, and said rule has to point at the host that requested it, otherwise it's rejected), and shows what ports are forwarded on what protocol.

Never mind the fact that the firewall should reject outside communication before it even gets to the UPnP/NAT-PMP daemon anyway, if it isn't being blocked you have bigger issues.

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

"Without it you'd have to manually open every single port those services and similar ones use."

So -- your talking a handful of ports at most.. UPnP is to allow unsolicted inbound traffic to get through your nat router. Traffic initiated by you, or in answer to your traffic is allowed.

Most people have no use of UPnP, it has been a nightmare since it was created -- who in their right mind thought, hey lets allow ports to be opened on your gateway/firewall without any sort of auth at all!!

And no UPnP should not be reachable via your public IP that is for damn sure.

Grand Master

spaceelf

Posted
Posted

I disable it anyway. The fact that UPnP, by design, lets any application communicate with the router and open ports should make any security conscious user uneasy.

If you trust what's in your network and have the routers firewall up I don't see how it could.

Grand Master

+BudMan MVC

Posted
  • MVC
Posted

^ the point is UPnP can remove your firewall settings. Without even a nod to you that its doing so, nor any sort of auth method to allow it.

There really needs to be some form of notification and auth to the mechanism - and then sure it would be a valid tool in opening firewall ports for the masses.

Grand Master

xendrome

Posted
Posted

THE EQUIPMENT AT THE TARGET IP ADDRESS

DID NOT RESPOND TO OUR UPnP PROBES!

Why would you disable uPnP anyways? It allows internal hosts to dynamically open ports like XBL or PSN for gaming and voice. Without it you'd have to manually open every single port those services and similar ones use. Just keep your internal hosts clean.

It would allow any malicious program to actively contact your router, open whatever ports it wants, and then transmit data through those ports all without your knowledge.... pretty big security hole if you ask me.

Steve Gibson, the person who creates the most FUD on the internet with his crazy rants and observations!!!

I'm not going to argue that the fact that he is crazy, which he probably is, but he is also very smart. And Facts do not = FUD.

Are you up to date on this UPnP issue? The typical way UPnP works is, an active program on one of the systems on your network will contact the router and open ports for whatever program/service to pass data through. Sounds ok right, well there is an exploit on a TON of routers that allows that request to be made from the OUTSIDE over the WAN, so if you have one of these affected routers, anyone outside your network, can open up ports into your network using a little bit of packet "magic". It's a pretty big deal.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Google reportedly limited Meta's Gemini access over limited AI compute

      By Karthik Mudaliar · Posted

      Google reportedly limited Meta's Gemini access over limited AI compute by Karthik Mudaliar Google is reportedly limiting Meta's use of its Gemini AI models after Meta tried buying more computing capacity than even Google could supply. According to the Financial Times, Google told Meta in March that it could not provide the full Gemini capacity that Meta had requested. This shortfall even disrupted and delayed some of Meta's internal projects. Due to this, Meta even told its employees internally to use AI tokens more efficiently. Meta wasn't the only one to get hit by this sudden refusal by Google; even other customers were affected. But Meta was hit harder because of its unusually high demand for Google's models. The move from Google makes it evident that companies all over are in limited supply of both infrastructure and compute. Alphabet said in April that Google Cloud revenue grew 63% year-over-year to $20 billion in the first quarter, helped by enterprise AI infrastructure and AI solutions. In pursuit of more compute, Meta had earlier signed a multi-billion-dollar AWS agreement as well as a large AMD GPU deal for AI data centers. But the crunch would be short-lived as both Meta and Google have also ramped up infrastructure investments heavily. Meta said in November that it was committing more than $600 billion in the U.S. by 2028 for AI technology, infrastructure, and workforce expansion. In the first quarter of this year, Meta also raised its expected capital expenditure for 2026 to a range of $125 billion to $145 billion, citing higher component pricing and additional data center costs for future capacity. However, this doesn't make the company immune to the current dependence on outside suppliers. Meta has also spent many years promoting Llama as an open-weight alternative to closed models from Google, OpenAI, and Anthropic. But if the reported reliance on Google's Gemini models is severe enough for internal work to get impacted, then it looks like even frontier labs and Big Tech aren't fully self-sufficient. Source: Financial Times
    • Samsung, Amazon extend 990 PRO 2TB NVMe SSD deal beyond Prime Day 2026

      By seeprime · Posted

      I like to reminisce about the good old days, way back in autumn 2025 when building a gaming machine was fun and the drives were about $150 when you caught a deal. Yes duh, back in the day we had it gone. Then baby Skynet came along, hiding in AI datacenters demanding more processing power until it reached singularity. End of a not totally fictional story.
    • Bypassed Windows 11 shows surprising stability on ancient, completely unsupported hardware

      By +Spark99 · Posted

      My experience in the past with older Windows 11 builds was not great on unsupported machines but I recently used Rufus to put the latest build on a older 5th Gen Core Thinkpad T that we upgraded with a SATA SSD and 8GB of RAM four years ago when hardware was reasonable and it seemed pretty fast and solid. Customer is very happy with the performance and will probably get four more years out of that venerable laptop that he loves so much. Another customer just retired his Dell Studio laptop from 2009 running Windows 10. It got an SSD over 10 years ago and did everything he needed it to for 17 years but he also retired last year and is happy doing everything on his iPad now.
    • Apple's newest AirTag 2 gets first big discount

      By TarasBuria · Posted

      Apple's newest AirTag 2 gets first big discount by Taras Buria In late January 2026, Apple introduced its second-generation AirTag trackers, bringing a refresh to the old model that has been on the market for half a decade. Now, you can get these new trackers at an all-time low price, thanks to the first big discount that brought the price down by 17% on Amazon. While the second-generation AirTag looks identical to its predecessor, it packs meaningful upgrades inside. The second-gen ultrawideband chip works 50% farther than the original AirTag, allowing you to detect lost items in a wider range. In addition, the second-generation AirTag features an upgraded Bluetooth chip for extended range and a significantly louder speaker (up to 50%) so that you can hear it better when locating a lost item. Note that the second-gen AirTag only works with iPhones and iPads that run iOS/iPadOS 26 and newer, so you need a compatible device to use the tracker. Like the original AirTag, the AirTag 2 is available in two packs: one and four pieces. Both are now available at a notable discount on Amazon, and you can purchase them using the links below. Apple AirTag 2 tracker - $24 | 17% off on Amazon Apple AirTag 2 tracker (four-pack) - $89 | 10% off on Amazon Good to know This Amazon deal is U.S.- specific and not available in other regions unless specified. We only use first-party seller links (at the time of article publishing); ensure that you purchase from a first-party seller link only. Check out Today's Deals on Amazon | or our recent tech deals. Become a Prime member (for Students or SNAP) via Neowin Get Prime Access - Prime for half price (for qualifying Medicaid, EBT, SNAP) Subscribe to Prime Video, Audible Plus, Music Unlimited or Kindle Unlimited via Neowin As an Amazon Associate, we earn from qualifying purchases.
    • Tidal won't monetize AI slop music, company says

      By monterxz · Posted

      I've been on Deezer for over a decade, but glad that Tidal joined them in fighting AI slop. Can't stand such takes as Spotify's: "Spotify's CEO recently pushed back against listeners who call AI music "slop," urging people to stop using the term and instead embrace the creative potential of AI music."

  • Recent Achievements

    • Reacting Well
      NovaEdgeX earned a badge
      Reacting Well
    • Week One Done
      NovaEdgeX earned a badge
      Week One Done
    • One Year In
      BA the Curmudgeon earned a badge
      One Year In
    • Conversation Starter
      rosiecharles earned a badge
      Conversation Starter
    • First Post
      KMilenkoski1202 earned a badge
      First Post

  • Popular Contributors

    1. 1
      +primortal
      536
    2. 2
      +Edouard
      267
    3. 3
      PsYcHoKiLLa
      150
    4. 4
      Steven P.
      98
    5. 5
      macoman
      66
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!