Has anyone heard if the report by Rapid7, on UPnP protocol is on the up and up?

Here's one link to a press release, from yesterday:

https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play

I am wondering if this is legit, or a "the sky is falling" syndrome and thought I would ask my fellow SW what their thoughts were!