Streamers and security

[wklie]

On 6/19/2020 at 6:34 PM, Cebolla said:

Case in point - what UPnP/DLNA streamer manufacturers have checked and (where required) updated their devices to comply with the recently updated OCF UPnP Device Architecture 2.0 specification, to avoid the CallStranger vulnerability?

 

I need more time to look into the potential impact, if any, but If I'm not mistaken, typical streamers are not internet-facing in the context of the CallStranger.  Our streamers cannot be accessed or controlled over the internet except via Spotify Connect.

[wklie]

I am in contact with our UPnP stack provider for this issue.

 

Although this task shall remain on my To-Do list in the coming weeks or months, this post does not constitute a promise to address this issue.

[wklie]

On 6/19/2020 at 6:34 PM, Cebolla said:

Case in point - what UPnP/DLNA streamer manufacturers have checked and (where required) updated their devices to comply with the recently updated OCF UPnP Device Architecture 2.0 specification, to avoid the CallStranger vulnerability?

 

Lumin Firmware 13.1 fixes the UPnP CallStranger vulnerability.  It is available for all 10 models of network music players and transports ever released by Lumin, including discontinued models.

 

Thanks for the links.