Full Report
An unpatched vulnerability in Calix GS7 XGS (GS5239XG) residential routers used by multiple U.S. broadband providers allows remote, unauthenticated attackers to create port-forwarding rules that can expose local network devices to the public internet. [...]
Analysis Summary
# Vulnerability: Unauthenticated WAN UPnP Port Mapping in Calix Routers
## CVE Details
- **CVE ID:** CVE-2026-75501
- **CVSS Score:** Not explicitly listed in text (estimated **Critical/High** due to unauthenticated remote access)
- **CWE:** CWE-306 (Missing Authentication for Critical Function) / CWE-287 (Improper Authentication)
## Affected Systems
- **Products:** Calix GS7 XGS (also marketed as GigaSpire 7u10txg).
- **Versions:** Firmware EXOS/6.6.47.
- **Configurations:** Devices with the MiniUPnPd control endpoint exposed on the WAN interface.
## Vulnerability Description
The vulnerability stems from the router binding its **UPnP WANIPConnection SOAP service** to the public WAN interface on **TCP port 5000** without any access control mechanisms. Under normal circumstances, UPnP (Universal Plug and Play) should only be accessible from the local network (LAN). Because this endpoint is exposed to the internet, a remote attacker can send unauthenticated SOAP requests to the router's public IP address to manipulate the device’s Network Address Translation (NAT) tables.
## Exploitation
- **Status:** PoC available; Technical details publicly disclosed by researcher Brian Khan Quintana.
- **Complexity:** Low (Requires a single unauthenticated HTTP/SOAP request).
- **Attack Vector:** Network (Remote/Internet-based).
## Impact
- **Confidentiality:** High (Internal devices like NAS and cameras are exposed to the public internet).
- **Integrity:** High (Attackers can create, delete, or enumerate port-forwarding rules; rules persist after reboots).
- **Availability:** Medium (Attackers can disrupt existing port mappings or fill the mapping table).
## Remediation
### Patches
- **None:** As of the report date, the vendor (Calix) has not responded to disclosure attempts, and no official patch is available.
### Workarounds
- **Disable UPnP:** Users should manually disable UPnP via the administrative web interface:
- Navigate to **Advanced** → **Security** → **UPnP** and set to **Disabled**.
- **ISP Intervention:** If the administrative settings are locked by the provider, users are advised to contact their Broadband Provider/ISP to request that UPnP be disabled remotely.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected port-forwarding rules in the router configuration.
- Active listening service on TCP port 5000 on the WAN interface.
- **Detection Methods:**
- **External Scanning:** Perform a port scan (e.g., using Nmap) on the router's public IP for TCP port 5000.
- **Log Review:** Check for unusual SOAP requests or UPnP service activity if logging is available.
## References
- **CERT/CC Vulnerability Note:** hxxps[://]kb[.]cert[.]org/vuls/id/756733
- **Researcher Technical Write-up:** hxxps[://]drkq[.]github[.]io/security-research/calix-vu756733/
- **Vendor Product Page:** hxxps[://]www[.]calix[.]com/products/platform/unlimited-subscriber/gigaspire/wi-fi-7-systems[.]html