What Is UPnP? The Security Risks of Universal Plug and Play

UPnP — Universal Plug and Play — is a set of networking protocols that lets devices on the same local network discover one another and configure connectivity automatically, with no manual setup. It is why a games console or media server can "just work" without anyone touching the router. It is also one of the most quietly risky features a home or small-office network can leave switched on.

What UPnP does

UPnP is really a family of protocols for zero-configuration networking: devices announce themselves, describe what they can do, and arrange to talk to each other without a human configuring anything. On a router, the part that matters for security is UPnP-IGD (Internet Gateway Device). It lets a device on the local network ask the router to open a port and forward incoming internet traffic to that device.

Normally, letting an outside connection reach a device behind a router requires a port-forwarding rule — an administrator deciding "traffic arriving on this port goes to that machine." UPnP-IGD automates that step. A game asks the router to open the ports it needs; the router complies; the game works. No menus, no manual rules. A "UPnP router" is just a router with this feature, and most consumer routers ship with it enabled by default.

The automatic port-forwarding risk

The convenience is exactly the danger. UPnP was designed on the assumption that anything already on the local network is trustworthy, so it generally performs no authentication. There is no approval prompt and usually no notification. That means any program on your network can silently tell the router to open a port and forward it — and that "any program" includes malware.

Picture a device on your network getting infected. With UPnP enabled, the malware does not need to defeat your firewall; it simply asks the router, politely and automatically, to open a hole and forward a port to the infected machine. The router obliges. An internal service that should never have been reachable from outside is now exposed to the internet, and nothing warned you. The firewall that was supposed to protect you has been reconfigured from the inside by the very thing it was meant to keep contained — a bypass in the same spirit as the tunnels described in our hidden-proxy explainer.

Internal UPnP versus WAN-exposed UPnP

It is worth separating two scenarios, because one is bad and the other is far worse.

• UPnP reachable only from the LAN (the normal case). The risk is that trusted-by-default model: any local device, including compromised ones, can open ports. Bad enough, and the reason the safe default is "off."
• UPnP reachable from the WAN (the severe case). Due to firmware bugs, some routers have historically exposed the UPnP control service on their internet-facing side. That lets a remote attacker manipulate your port forwarding from the outside, with no foothold on your network at all — a direct, remote path to opening your network up. This has been found across large numbers of consumer devices over the years and is a genuine, serious misconfiguration.

Confirming your router is not in that second category is one of the highest-value checks you can run on a home network. An external exposure check — the kind of outside-in look a reputation and exposure checker provides — tells you what the internet can actually see.

When to disable UPnP

For most networks, the right default is to turn UPnP off on the router. The security benefit — removing a silent, unauthenticated way for any device to open ports — almost always outweighs the convenience. The practical cost is that some games, consoles and peer-to-peer applications lean on UPnP for the smoothest connectivity, so you may need to create a small number of port-forwarding rules by hand.

That manual forwarding is the more secure approach precisely because it is deliberate and visible. You decide exactly which ports are open and to which device, rather than delegating that decision to whatever software happens to be running. If you genuinely need UPnP, confine it to trusted devices, keep the router firmware patched so WAN-exposure bugs are fixed, and periodically review the router's UPnP status page for forwarding rules you did not expect. Applying least privilege to your own network edge is the same mindset behind zero trust: nothing gets access just because it asked.

The takeaway

UPnP solves a real convenience problem by letting devices configure the network themselves — but it does so by trusting everything on the local network and asking no questions. That makes it a quiet way for malware to punch holes in your firewall, and, when routers expose it to the internet, a remote attack path outright. Unless you have a specific need, disable it, forward the few ports you actually require by hand, keep firmware current, and verify from the outside that UPnP is not reachable from the internet.

Frequently asked questions

What is UPnP? Universal Plug and Play: protocols that let devices on a local network discover each other and configure connectivity automatically. On routers, UPnP-IGD lets devices request automatic port forwarding.

What is a UPnP router? A router that supports the UPnP Internet Gateway Device feature, so devices can open and forward ports themselves without an administrator. Most consumer routers enable it by default.

Why is it a security risk? UPnP trusts any device on the LAN and usually requires no authentication, so any program — including malware — can silently open ports. Some routers have also exposed UPnP to the internet, allowing remote abuse.

Should I disable it? For most networks, yes. Disable UPnP and forward the few ports you actually need by hand, which is deliberate and visible rather than letting any device open what it likes.

How do I check if it is exposed? Use an external exposure check to confirm UPnP is not reachable from the internet side of your router, and review the router's UPnP page for unexpected forwarding rules.