CVE-2020-12695: ASUS Rt-n11

High severity, CVSS 7.5. EPSS: 15.2% chance of exploitation in the next 30 days.

The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.

Affected products

• ASUS Rt-n11: affected versions not specified
• Broadcom Adsl: affected versions not specified
• Canon Selphy CP1200: affected versions not specified
• Canonical Ubuntu Linux: version 20.04 only
• Cisco WAP131: affected versions not specified
• Cisco WAP150: affected versions not specified
• Cisco WAP351: affected versions not specified
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Dell b1165nfw: affected versions not specified
• D-Link Dvg-n5412sp: affected versions not specified
• Epson Ep-101: affected versions not specified
• Epson Ew-m970a3t: affected versions not specified
• Epson m571t: affected versions not specified
• Epson XP-100: affected versions not specified
• Epson XP-2101: affected versions not specified
• Epson XP-2105: affected versions not specified
• Epson XP-241: affected versions not specified
• Epson XP-320: affected versions not specified
• Epson XP-330: affected versions not specified
• Epson XP-340: affected versions not specified
• Epson XP-4100: affected versions not specified
• Epson XP-4105: affected versions not specified
• Epson XP-440: affected versions not specified
• Epson XP-620: affected versions not specified
• Epson XP-630: affected versions not specified
• and 192 more

Published 2020-06-08. Last modified 2026-06-17.