Editing Universal Plug and Play (section)

===Access from the Internet===
In 2011, researcher Daniel Garcia developed a tool designed to exploit a flaw in some UPnP IGD device stacks that allow UPnP requests from the Internet.<ref>{{cite web | title=UPnP Mapping | url=https://www.defcon.org/images/defcon-19/dc-19-presentations/Garcia/DEFCON-19-Garcia-UPnP-Mapping.pdf |first=Daniel |last=Garcia |access-date=11 September 2014}}</ref><ref>{{cite web | title=US-CERT Vulnerability Note VU#357851 | url=http://www.kb.cert.org/vuls/id/357851 |date=30 November 2012 |access-date=11 September 2014 |publisher=[[CERT Coordination Center|CERT/CC]]}}</ref> The tool was made public at DEFCON 19 and allows portmapping requests to external IP addresses from the device and internal IP addresses behind the NAT. The problem is widely propagated around the world, with scans showing millions of vulnerable devices at a time.<ref>{{cite web |url=http://www.h-online.com/security/news/item/Millions-of-devices-vulnerable-via-UPnP-1794032.html |title=Millions of devices vulnerable via UPnP - Update |date=30 January 2013 |access-date=11 September 2014 |publisher=The H }}</ref>

In January 2013, the security company Rapid7 in Boston reported<ref>{{cite web | title=Whitepaper: Security Flaws in Universal Plug and Play: Unplug, Don't Play. |url=https://community.rapid7.com/docs/DOC-2150 | access-date= 11 September 2014 |date=29 January 2013 |first=H. D. |last=Moore}}</ref> on a six-month research programme. A team scanned for signals from UPnP-enabled devices announcing their availability for internet connection. Some 6900 network-aware products from 1500 companies at 81 million IP-addresses responded to their requests. 80% of the devices are home routers; others include printers, webcams and surveillance cameras. Using the UPnP-protocol, many of those devices can be accessed and/or manipulated.

In February 2013, the UPnP forum responded in a press release<ref>{{cite web | title=UPnP Forum Responds to Recently Identified LibUPnP/MiniUPnP Security Flaw. |url=http://upnp.org/news/documents/UPnPForum_IGDSecurity_PressRelease_Feb2013.pdf| access-date= 11 September 2014 |date=8 February 2013 |publisher=[[UPnP Forum]] }}</ref> by recommending more recent versions of the used UPnP stacks, and by improving the certification program to include checks to avoid further such issues.