DH with AES - is that an acceptable security scheme over UPnP? I'm trying to devise a good security scheme to protect comms over Wi-Fi.

Right now, I have 2 devices that already communicate via UPnP but I need to secure this communication. I've come up with this:


Once the client sees the other host, picks a pair of Diffie-Hellman parameters (out of 1000 pregenerated pairs of $g$ and $p$) and enacts a DH key agreement with the host. This happens each time both devices want to initiate a session, and auth persistence is not needed (generated keys are discarded after the session finishes).
Once both devices have calculated the same secret, this secret is hashed with SHA-256 to create a common key.
When the client wants to send a message to the host, it encrypts it with AES-CBC-PKCS#7, using the key, it appends the generated IV and sends it to the host. The host's response follows the same method.


Whoever observes a session can only see $g$, $p$, $A$, $B$, the ciphertexts and their corresponding $IV$s.

Is this secure enough?

P.D.: I'm under the impression that trying to use TLS is way too much for such a simple need and it would be too complicated to get out in a reasonable timeframe.
No. First, you've exposed a padding oracle by using unauthenticated AES. Secondly, you've not authenticated the devices: it's easy to mount a man in the middle attack. Thirdly, I don't understand the role of changing parameters all the time in your protocol.