CVE-2025-21300
📋 TL;DR
This vulnerability in Windows Universal Plug and Play (UPnP) Device Host service allows attackers to cause a denial of service by sending specially crafted requests. It affects Windows systems with UPnP enabled, potentially causing service crashes or system instability. Organizations using Windows devices with UPnP functionality are at risk.
💻 Affected Systems
- Windows Universal Plug and Play (UPnP) Device Host
📦 What is this software?
Windows 10 1507 by Microsoft
Windows 10 1507 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1607 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 22h2 by Microsoft
Windows 11 23h2 by Microsoft
Windows 11 24h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or persistent denial of service requiring reboot, potentially affecting multiple systems in a network environment.
Likely Case
UPnP service crash causing temporary loss of device discovery and control functionality until service restart.
If Mitigated
Minimal impact with proper network segmentation and UPnP disabled on internet-facing systems.
🎯 Exploit Status
Exploitation requires network access to the UPnP service. No authentication is required to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Microsoft Security Update Guide for specific KB numbers
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21300
Restart Required: Yes
Instructions:
1. Apply latest Windows security updates from Microsoft Update. 2. Restart affected systems. 3. Verify UPnP service is running properly after restart.
🔧 Temporary Workarounds
Disable UPnP Service
windowsDisable the UPnP Device Host service to prevent exploitation
sc config upnphost start= disabled
sc stop upnphost
Block UPnP Network Traffic
allBlock UPnP traffic at network perimeter
🧯 If You Can't Patch
- Disable UPnP service on all affected systems
- Implement network segmentation to isolate UPnP traffic
🔍 How to Verify
Check if Vulnerable:
Check if UPnP service is running and system has not applied the security patchCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify Windows Update history shows the security patch applied and UPnP service is running without issues📡 Detection & Monitoring
Log Indicators:
- UPnP service crash events in Windows Event Log
- System instability or reboot events
Network Indicators:
- Unusual UPnP traffic patterns
- Multiple UPnP requests from single sources
SIEM Query:
EventID=7034 AND ServiceName="UPnP Device Host" OR EventID=1000 AND Source="UPnP"