# How UPnP is vulnerable if the attacker is not connected in the same network?

I read a lot about UPnP vulnerability and I understand it to some extent. What I don't understand is how attacker will attack if he is not connected to the same network. I read how attacker can do port mapping on the router. But to do that, attacker has to connect to the router in the first place which will require him to know the password. So unless it is a public network, I don't understand how the attacker will be able to achieve his target.

Basically I am trying to understand how attacker will be able to reach an UPnP device in my home network if he is not connected on the network.