The Open Connectivity Foundation UPnP specification before
2020-04-17 does not forbid the acceptance of a subscription request
with a delivery URL on a different network segment than the fully
qualified event-subscription URL, aka the CallStranger issue. This
tool checks for the vulnerability.
