{"id":"CVE-2026-107038","kind":"vulnerability","aliases":["CVE-2026-107038"],"related":[],"title":"Yet Another UPnP Controller: exported component lets attackers read and control app data","description":"Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.","summary":"Yet Another UPnP Controller (Android app, versionCode 50200) exposes an exported component without proper permissions. An unauthorized attacker can invoke it to access arbitrary application data and control it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","other","upnp"],"not_affected_if":[],"how_to_check":"- Check the installed app version in the app's settings or package details; the sources name versionCode 50200 as affected","fix":null,"status":"open","published_at":"2026-10-29T16:17:49+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:32:19+00:00","updated_at":"2026-10-29T16:32:19+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-29T16:32:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Yet Another UPnP Controller: exported component lets attackers read and control app data","impact":"medium","summary":"Yet Another UPnP Controller (Android app, versionCode 50200) exposes an exported component without proper permissions. An unauthorized attacker can invoke it to access arbitrary application data and control it.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","upnp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker reads and controls the app's data","analyst_note":"Confirm affected versions, fix version and whether the exported component is reachable from other installed apps, using the NVD entry linked in the sources.","how_to_check":"- Check the installed app version in the app's settings or package details; the sources name versionCode 50200 as affected\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Users of the Yet Another UPnP Controller app at versionCode 50200, the affected build named in the NVD entry. The sources do not say whether other versions are affected or whether any configuration changes exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000632,"input_tokens":4087,"output_tokens":447,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107038':16A,19A '-2026':15A,18A '50200':30B,59C 'access':45B,72C 'allow':60C 'android':20B,27B 'anoth':2A,24B,55C 'app':12A,28B 'applic':47B,76C 'arbitrari':46B,70C 'attack':8A,40B,62C 'compon':6A,34B,67C 'control':4A,11A,26B,50B,57C,74C 'cve':14A,17A 'data':13A,48B,71C,77C 'export':5A,33B,66C 'expos':31B 'insecur':51C 'invok':42B,64C 'lead':68C 'let':7A 'permiss':37B,52C 'proper':36B 'read':9A 'unauthor':39B,61C 'upnp':3A,22B,25B,56C 'versioncod':29B,58C 'without':35B 'yet':1A,23B,54C","nicknames":[],"mitigations":[],"who_affected":"Users of the Yet Another UPnP Controller app at versionCode 50200, the affected build named in the NVD entry. The sources do not say whether other versions are affected or whether any configuration changes exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T16:17:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107038","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107038","severity":null,"published_at":"2026-10-29T16:17:49+00:00","modified_at":"2026-10-29T16:17:49+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}