CVE-2020-12695

HIGH 7.5CVE-2020-12695 · Published 08/06/2020 · updated 17/06/2026

In short

CVE-2020-12695 is a HIGH (CVSS 7.5) vulnerability affecting hostapd (w1.fi).
Chance of exploitation in the next 30 days (EPSS): 15.2%, higher than 96.8% of all vulnerabilities.
Fix: update to 2.0.0 or later.

Package	Affected versions	Patched versions
hostapd w1.fi	`< 2.0.0`	`2.0.0`

Description

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

References

packetstormsecurity.com/files/158051/CallStranger-UPnP-Vulnerability-Checker.html · Third Party Advisory
openwall.com/lists/oss-security/2020/06/08/2 · Mailing List
corelight.blog/2020/06/10/detecting-the-new-callstranger-upnp-vulnerability-with-zeek · Third Party Advisory
corelight/callstranger-detector · Third Party Advisory
yunuscadirci/CallStranger · Third Party Advisory
lists.debian.org/debian-lts-announce/2020/08/msg00011.html · Third Party Advisory
lists.debian.org/debian-lts-announce/2020/08/msg00013.html · Third Party Advisory
lists.debian.org/debian-lts-announce/2020/12/msg00017.html · Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3SHL4LOFGHJ3DIXSUIQELGVBDJ7V7LB · Mailing List

More vulnerabilities in hostapd

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

hostapd

w1.fi

< 2.0.0

2.0.0

More vulnerabilities in hostapd

See all →