CVE-2020-12695

CVE-2020-12695, known as "CallStranger," is a critical vulnerability in the Open Connectivity Foundation UPnP specification that allows subscription requests to be accepted from different network segments. This flaw impacts a wide range of products from numerous vendors, including Microsoft, Cisco, Dell, and HP. With a CVSS score of 7.5 (HIGH), it presents a significant risk due to its network-based attack vector and high potential for data exfiltration, reflected amplified TCP DDoS attacks, and port scanning, despite requiring high attack complexity. While there is no evidence of active exploitation in the wild or publicly available exploit code in Metasploit or ExploitDB, the vulnerability has garnered substantial community attention and media coverage, indicating its potential for future exploitation.