CVE-2023-36585
📋 TL;DR
This vulnerability in Windows upnphost.dll allows attackers to cause a denial of service (DoS) by sending specially crafted requests to the Universal Plug and Play (UPnP) service. It affects Windows systems with the UPnP service enabled, potentially causing system crashes or service disruptions.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h1 by Microsoft
Windows 10 21h1 by Microsoft
Windows 10 21h1 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 22h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash requiring reboot, disrupting all services on the affected machine
Likely Case
UPnP service crash causing temporary loss of UPnP functionality until service restart
If Mitigated
Minimal impact with proper network segmentation and UPnP disabled on internet-facing systems
🎯 Exploit Status
Exploitation requires network access to UPnP service (port 2869/tcp typically). No authentication needed to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: October 2023 security updates (KB5031356 for Windows 10, KB5031354 for Windows 11, etc.)
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36585
Restart Required: Yes
Instructions:
1. Install October 2023 Windows security updates via Windows Update. 2. Alternatively, download and install the specific KB patch for your Windows version from Microsoft Update Catalog. 3. Restart the system after installation.
🔧 Temporary Workarounds
Disable UPnP Service
windowsDisables the UPnP Device Host service to prevent exploitation
sc config upnphost start= disabled
sc stop upnphost
Block UPnP Network Access
windowsBlocks network access to UPnP service via firewall
netsh advfirewall firewall add rule name="Block UPnP" dir=in action=block protocol=TCP localport=2869
🧯 If You Can't Patch
- Disable UPnP service on all affected systems
- Implement network segmentation to restrict access to UPnP service (port 2869/tcp)
🔍 How to Verify
Check if Vulnerable:
Check if October 2023 security updates are installed via 'systeminfo' command or Windows Update historyCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify patch installation with 'wmic qfe list' or check Windows Update history for KB5031356/KB5031354📡 Detection & Monitoring
Log Indicators:
- Event ID 1000 in Application logs with faulting module upnphost.dll
- UPnP service crashes in System logs
Network Indicators:
- Unusual traffic to port 2869/tcp
- Multiple connection attempts to UPnP service
SIEM Query:
source="windows" event_id=1000 faulting_module="upnphost.dll"