This tool is from Jonathan Squire's presentation "A Fox in the Hen House (UPnP IGD)", presented at Blackhat 2008.

[UPnPwn] and its associated libraries are implemented in the Ruby programming and provide basic classes for interacting with SSDP and UPnP enabled devices
UPnPwn itself: hxxp://blackhat.com/presentations/bh-usa-08/Squire/Squire_Extras.zip
Presentation video: hxxps://media.blackhat.com/bh-usa-08/video/bh-us-08-Squire/black-hat-usa-08-squire-UPnP-IGD-hires.m4v
Presentation audio: hxxps://media.blackhat.com/bh-usa-08/audio/black-hat-usa-2008-Squire-UPnP-IGD.m4b
White Paper: hxxp://blackhat.com/presentations/bh-usa-08/Squire/BH_US_08_Squire_A_Fox_in_the_Hen_House%20White%20P aper.pdf

"Quickstart Guide" to perk your interest:
Code:
Add a port forward from ANY -> WAN:1234/TCP -> 192.168.88.10
./UPnPwn.rb  --portmap add 1234 TCP 192.168.88.10

Delete portmap ANY -> WAN:1234/TCP -> 192.168.88.10
./UPnPwn.rb --portmap del 1234 TCP

Add a port forward from 11.22.33.44 -> WAN:4444/TCP -> 192.168.88.11:5555
./UPnPwn.rb --portmap add 11.22.33.44 4444 TCP 5555 192.168.88.11

Delete portmap 11.22.33.44 -> WAN:4444/TCP -> 192.168.88.11:5555
./UPnPwn.rb --portmap del 11.22.33.44 4444 TCP

Run a test server (for testing your portmappings, it will run on 0.0.0.0:1234)
./UPnPwn.rb --test_server

List all portmappings on a device
./UPnPwn.rb --list

Listen to the network for all SSDP traffic (this is a good way to find other UPnP Devices)
./UPnPwn.rb --ssdp_listen

Get info about first found IGD
./UPnPwn.rb --info