Just how much of a risk am I putting on my network by allowing UPnP

Question

I am facing a serious conundrum (to me at least). Whether or not to disable UPnP on my network. I understand the risk, an infected computer could punch a hole in my firewall, and more infections can follow. I would disable UPnP, but the people who are on my network are not really savvy enough to go to the router IP, and set up a forwarded port so their stuff will work. But they has pretty safe browsing habits. No clicking on weird links, or "You won" buttons. (uBlock has really helped this, except on phones). Antivirus on all Mac/Windows devices, android and chromebook everywhere else. I am not always able to do network stuff for lengths of time for a variety of reasons.

So as the title says, just how much of a risk would I be put on this network by leaving UPnP on? (This is not a business network, running servers that connect to the outside world, just a simple network for a few people in a building.

Bonus: I just realized UPnP has been running on my router for at least five years, and nothing has happened yet. I know that nothing in the past does not mean nothing in the future, but I thought I would mention it.

Answer 1

UPnP's authentication model is, for the most part, "did I get a UPnP packet? yes? cool, I'll do whatever it says". The reason that this is generally considered acceptable (at least in home environments) is that the UPnP server only listens on the internal network, which is considered trusted.

Problems with UPnP arise if your threat model includes an attacker who has access to your network. Many routing devices support a wide range of configuration via UPnP, including DNS settings and routing tables, which may enable man-in-the-middle attacks against your traffic if maliciously configured.

A common place you'll see dangerous UPnP configurations is small hotels and businesses offering free WiFi. The routers are often consumer devices left in their default state, with UPnP enabled, so anyone can configure them because, by business requirement, untrusted people have access to the network.

For the large part it makes sense to just turn UPnP off if you're not expecting to have lots of unknown programs needing dynamic port forwarding. You should also verify that UPnP is actually switched off when you disable it on a settings page; there are numerous cases of consumer routers where the UPnP disable functionality either does not work at all, or only alters the boot config to not launch UPnP on next boot without stopping the existing UPnP daemon.

If you're concerned about UPnP but do require it for administration, find a way to move the UPnP listener onto an administrative VLAN rather than the primary VLAN.

Answer 2

The risk is totally dependent on your risk appetite and your convinence vs security trade off.

Leaving it open does increase risk, its safer to have it closed, as you have identified. But the convience is lost, which you have also identified. Only you and your client can assess which is more important.

If you want more security definitely turn it off. I always turn it off by default, which is opposite to most manufacturers. If I find someone who needs it, I enable it and explain the risk. I have found many networks, certainly small office ones, work fine without it