From what I understand the problems with UPnP w.r.t. security are that it lacks any authentication - for something that can change your firewall rules this is in general a bad thing.
First of all I would suggest using a stricter set of firewall rules than the default, e.g. something like shorewall (although it takes a bit of configuration to get UPnP working with shorewall, have to create a new zone for broadcast address, etc). UPnP really has be restricted to trusted users somehow.
To quote from the linux-igd SECURITY file:
UPnP version 1.0, of which this program is based, is inherently flawed. As
with most Microsoft supported software, there was a lot of theory put out
there, but no code. Well what happened is they made attempt to get this
concept of UPnP out there, and in the inital version they weren't concerned
with security or any advanced controls. Simply all they wanted was
connectivity. So we are stuck with this for now. The UPnP server, by itself,
does no security checking. If it recieves a UPnP request to add a portmapping
for some ip address inside the firewall, it just does it. This program will
attempt to verify the source ip contained in the UPnP request against the
source ip of the actualy packet, but as always, these can be forged. The
UPnP server makes no attempt to verify this connection with the caller, and
therefore it just assumes whoever asked is the person really wanting it.
Theoretically this could open up ports on some other box than the caller to
the outside world, and this is where intelligent decision making comes in.
If you restrict the ability of this to happen with iptables rules, then this
becomes a non-issue, and only the machines that iptables allows to have stuff
go to will be allowed. But sure, everyone can come up with some way to get
around this so listen.
I think OpenWrt's philosophy is to give users the choice, and certainly on of the features a lot of users want is UPnP as this is available on almost every other wireless router nowadays. As long as your firewall is resonably setup this isn't much of an issue, but like all other things security, ignorance of how to use the daemon properly is the greatest risk.
