A fairly new and obscure UPnP IGD implementation is 'upnpkits'. It uses a PHP like language, to dynamically create Bourne shell scripts, which are then executed by issuing a shell call. The PHP like scripts don't check anything at all, and the scripts work with full root privileges on the router. You can execute commands by issuing the command using shell backticks.