[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is UPnP? Yes, It's Still Dangerous in 2026](/blog/what-is-upnp) Publish date January 5, 2026 {x} minute read # What is UPnP? Yes, It's Still Dangerous in 2026 [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Greg Pollock](/team/greg-pollock) Director of Research and Insights Greg is a CISA-certified cybersecurity researcher who holds multiple patents for data leak detection. His findings have been featured in The New York Times, Forbes, and Wired. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) UPnP (Universal Plug and Play) is a service that allows devices on the same local network to discover each other and automatically connect through standard networking protocols (such as TCP/IP HTTP, and DHCP). Some examples of UPnP devices are printers, gaming consoles, WiFi devices, IP cameras, routers, mobile devices, and Smart TVs. UPnP can also modify router settings to open ports into a [firewall](https://www.upguard.com/blog/web-application-firewall) to facilitate the connection of devices outside of a network. This service reduces the complexity of networking devices by automatically forwarding router ports to new devices, removing the hassle of manual forwarding. But this convenience could come at significant security risks. ## Is UPnP Safe? The UPnP service becomes dangerous if it establishes connections with devices that are [infected with malware](https://www.upguard.com/blog/malware). Such connections make [DDoS attacks possible](https://www.upguard.com/blog/what-is-a-ddos-attack). But when UPnP allows safedevices to connect, the established network is safe. So the original intention of UPnP technology is safe. It only becomes dangerous when infected devices are involved. UPnP offers zero-configuration, meaning no human authentication is required to establish a connection. Ports are automatically forwarded to establish a connection when a UPnP request is received. With such an autonomous, and liberal, networking mechanism, it becomes clear how easy it is for the establishment of infected connections to spiral out of control. UPnP exploitation can result in more than just the connection of an infected device. Here are just a few examples of the malicious actions that are possible with UPnP: * Connecting internal ports to the router's external-facing side to create gateways ('poking holes') through firewalls. * Port forwarding the router web administration details * Port forwarding to any external server located on either their surface or dark web. * Changing DNS server settings so that a decoy credential stealing website is loaded instead of legitimate banking websites. * Modifying administrative credentials * Modifying PPP settings * Modifying IP settings for all interfaces * Modifying the WiFi settings * Modifying or terminate internal connections ## Should I Enable UPnP? Because it's so difficult to determine if a prospective connection could facilitate a malware infection, it's best security practice to disable UPnP. If port forwarding is an essential requirement (if you use [VoIP programs](https://www.nextiva.com/blog/what-is-a-virtual-phone-system.html), peer-to-peer applications, game servers, etc) it's better to [manually forward each port](https://www.howtogeek.com/66214/how-to-forward-ports-on-your-router/) so that you have control over each established connection). By default, most new routers come with UPnP enabled and many users are unaware that they're at risk of a malware infection [or a data breach](https://www.upguard.com/blog/prevent-data-breaches). The graph below indicates the number of devices with UPnP enabled compared to the total number of analyzed devices in each category. As you can see, routers are at the highest risk of being targeted in a UPnP attack. If you don't have an essential need for the UPnP feature, [you should disable it.](https://www.upguard.com/blog/what-is-upnp#toc-how-to-disable-upnp) ## Is UPnP Dangerous? Though the UPnP protocol is safe, it can facilitate insecure connections. A UPnP protocol could permit devices with critical [vulnerabilities](https://www.upguard.com/blog/vulnerability) to connect to your network and sensitive resources. The U.S Department of Homeland Security urged all businesses to disable their UPnP following a [cyberattack](https://www.upguard.com/blog/cyber-attack) in 2013[ impacting tens of millions of devices](https://www.zdnet.com/article/millions-of-pcs-exposed-through-network-bugs-security-researchers-find/). Though this was about 8 years ago, UPnP-related cyberattacks are still being detected today. To prevent such infectious connections from occurring, the entire attack surface associated with a UPnP connection must be kept updated with the latest patches. This includes routers, firewalls, antivirus software, and all [IoT (Internet of Things)](https://www.upguard.com/blog/internet-of-things-iot) devices that are to be connected. The [National Institute of Standards and Technology (NIST)](https://www.upguard.com/blog/nist-cybersecurity-framework) hosts a continuously updated list of [Common Vulnerability Exposures (CVEs)](https://www.upguard.com/blog/cve) for popular devices and software solutions. Security teams should regularly refer to this list to be aware of any new patch requirements impacting existing or prospective UPnP connections. The NIST national vulnerability database [can be accessed here](https://nvd.nist.gov/vuln/full-listing). More details about UPnP-specific vulnerabilities can be found on the [Carnegie Mellon University website](https://www.kb.cert.org/vuls/id/339275). If despite the very real risks, you still wish to leave UPnP enabled, refer to the updated UPnP security specifications outlined by the [Open Connectivity Framework](https://openconnectivity.org/upnp-specs/UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf). ## How to Disable UPnP The process of disabling UPnP is unique for each router. Perform a search online for instructions for your specific router. Search the following phrase in Google: *How to disable UPnP for \[your router name]* The general process is as follows: 1. Enter your router's IP address (home network) as a URL in a web browser and hit *Enter. *If you don't know what your router IP address is, [follow the instructions in this article](https://www.hellotech.com/guide/for/how-do-i-find-my-router-ip-address). 2. Select *Advanced *and then click *NAT Forwarding.* 3. Disable UPnP connectivity. UPnP should also be blocked at the internet gateway to prevent unauthorized devices from accessing ports 1900/UDP and ports 2869/TCP (for Windows). To maximize security, all ports should be blocked except those necessary to run the business - usually port 80/TCP is utilized on a daily basis. ## How Can Cyber Attackers Exploit UPnP? In general, router security policies are quite good at blocking hostile external connections, and an up-to-date firewall increases this resilience. But UPnP is capable of bypassing these security barriers by allowing unauthorized devices to 'poke holes' through firewall policies to established persistent malicious connections. Such an attack begins with a malware injection which commonly occurs via a [phishing campaign](https://www.upguard.com/blog/phishing). After a Trojan (or worm) is clandestinely installed, it bypasses the router's firewall to establish a hidden backdoor for 24/7 remote access by cybercriminals. Backdoors can remain undetected for several months - giving cyber attackers plenty of time to do a lot of damage. Threat actors can do the following through a webserver backdoor. * Exfiltrating sensitive data * Encrypting sensitive data and hold it hostage * Using the victim's systems to launch a [Distributed Denial of Service (DDoS)](https://www.upguard.com/blog/what-is-a-ddos-attack) attack. * [Defacing a victim's website](https://www.upguard.com/blog/signs-of-vendor-breach#toc-9-the-vendor-s-website-has-been-defaced) ## Examples of UPnP Cyberattacks Since the invention of Universal Plug and Play in 1999, there have been growing concerns about the security issues of the technology. The [F.B.I even issued an official warning](https://www.infosecurity-magazine.com/news/fbi-in-internet-of-things-cyber/?__cf_chl_jschl_tk__=a5f403881aa41d4ce680ca43ddd30e35371ef600-1626417243-0-Af2HbrjECcVgRuhelzTFeZXtTcIGt4d8pme-rst67SOakEZGfczw7S_SiYVoWKe8nMS3cyS-hdSdXbcQpuG49OgQeGsvMyHYOLJF0zK9uWX9zjVF_kWwuzXkp1FjmfT246XmUpcoinpQTVix7rzsET9kP266yg2lHZXkhuXP1DYdcWl9QeX-f9eYJN_r_kbihIXmAW6Mr8_PmZn0fb1_-BkoSg_4ShY9pvA25CiI_IWwuDrxFl2Du4nbV_L9RE-HRdCYBgbXmQktLgNhKmavD1C9257WwzoqeULH67iez_v994I0KiN3nsIsivsn2YT8vi-kdza3x9RMlYjrT1fk58TfKTu4iP-Q-zhuULa_WI2FEwWYR9cAIGZpmxlzs_m8vovTGW9g-ODuop3x8oEcKr-os2nkYlBzJ4gIbQAIRz3vlbAR4n5JSSEoE0Jph473fw) about the potential exploits of UPnP technology and [IoT devices](https://www.upguard.com/blog/internet-of-things-iot). These warnings have been corroborated by the many cyberattacks that were made possible through UPnP technology Some famous UPnP related cyberattacks are outlined below: ### Flash UPnP Attack First discovered in 2008, the Flash UPnP attack is a type of cyberattack that is autonomously executed when a user interacts with a malicious SWF file (specially crafted Flash applet) running on a web page. This action triggers a silent step attack in the background where the victim's router forwards its ports, exposing its connections to the entire internet. Though the name might imply otherwise, Flash UPnP attacks are not associated with any Flash vulnerabilities An enabled and updated firewall will give you the highest chances of defending against Flash UPnP attacks, though it is not guaranteed. ### Mirai Botnet Attack In 2016, cybercriminals executed a colossal Denial-of-service (DDoS) attack by compromising a network of IoT devices (mainly CCTV cameras) through UPnP technology. The cyberattack was so big, it caused an internet outage in most of the [United States East Coast.](https://www.wired.com/2016/10/internet-outage-ddos-dns-dyn/) ### Pinkslipbot Attacks The banking Trojan Pinkslipbot also knows as Qakbot and QBot, exploits UPnP to infect its victims. Infected machines are then used as [HTTPS-based proxies](https://www.upguard.com/blog/proxy-server) to control servers to hide the malicious activity being carried out. Plinkslipbot malware steals banking credentials from US financial institutions using man-in-browser attacks and password stealers. This family of malware was first discovered in the late 2000s and it's still active today. ### Reduce your Data Breach Risks with UpGuard UpGuard's attack surface management solution scans internal and third-party attack surfaces for overlooked vectors that could be exploited to facilitate breaches. For an overview of how UpGuard can compress your attack surface and decrease your data breach potential, watch the video below. eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)