What are the security implications of enabling UPnP in my home router?

Many modern home routers usually come with a feature called Universal Plug and Play (UPnP) to allow NAT traversal using the IGD Protocol. What that means is that an application can ask the router "Hey, could you please let external computers speak to me on port xxxx", then the router creates a port map for the requested port.

UPnP has a variety of security problems, the main of which is that it doesn't have any built-in authentication. One example is PoC by Petko D. Petkov where he demonstrated how Flash can be used to send UPnP commands to a local router when visiting a malicious page. UPnP also makes it much easier for malware on your computer to open ports and listen for commands from a C&C Sever.

Despite not being around for a long time, UPnP has a long list of security issues mainly due to poor implementation. Researchers at Rapid7 have shown that nearly 81-million IP addresses have responded to their UPnP requests (mind you, those requests are coming from external networks), and many of these devices had vulnerabilities that can lead to complete takeover.

So my advice is this: If you want port-forwarding, you probably want it for a reason for a specific program, so disable UPnP and map the ports yourself. It's not something you'll be doing everyday.

Most likely Universal Plug and Play is activated in your router which allows devices to ask for forwarded ports without the need for further router configuration.

Obviously this also implies some security risks.