I'm wondering what strategies and techniques are used to bypass firewalls which have universal plug and play. I'm aware of security issues regarding UPNP in the past but I've also heard that there are some persistent vulnerabilities with UPNP that have not been patched, presumably because it would negatively effect the usability of UPNP.
In this scenario, I am examining how an Internet of Things embedded device might be insecure despite of being placed behind a home firewall. Assuming the device had FTP enabled and no further controls on it, so that a simple FTP cracking attack would suffice, how would these UPNP firewall bypassing techniques be used to establish an unfiltered connection between the IoT device and said attacker?