Universal Plug and Play (UPnP) is a protocol which is in widespread use, supported by every major operating system and in use just about everywhere in the embedded world. In addition to home routers, it's providing functionality to devices such as DVD players, IP cameras, printers, televisions, media centers, HVAC and many more. Right now it is active on hundreds of millions of devices, many of them facing the Internet. While previous research has focused on directly exploiting the functionality or implementation of UPnP, there's an attack vector which has been overlooked. UPnP has client-side functionality which opens up a whole new attack surface. In our talk we discuss the client side of the protocol, present ways to reach this attack surface and demonstrate a PoC exploit against a major implementation.