{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/756733#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nThe Calix GS7 XGS GS5239XG router running firmware EXOS/6.6.47 contains a missing authentication vulnerability that exposes its UPnP (Universal Plug and Play) `WANIPConnection` service on the public WAN interface.\r\n\r\n### Description\r\nCalix GS7 XGS GS5239XG is a residential gateway that provides routing, NAT, and firewall functionality for home networks. The device includes the Universal Plug and Play (UPnP) service implemented via MiniUPnPd 2.3.7, a lightweight software program that provides features such as automatic port forwarding for applications and devices on the LAN. By default, the UPnP service is exposed on the device’s WAN interface and does not require authentication.\r\n\r\n**CVE-2026-75501** In affected firmware versions, the router binds its UPnP `WANIPConnection` SOAP service to the public WAN interface on TCP port 5000. Because the service does not require authentication when accepting SOAP requests, a remote attacker can obtain full access to the router’s critical UPnP functions including adding, deleting, and enumerating NAT port mappings. \r\n\r\n### Impact\r\nCVE-2026-75501 enables an unauthenticated, remote attacker to remotely query and manipulate existing NAT mappings. By exploiting this vulnerability to create arbitrary port-forwarding rules on the router, an attacker can bypass NAT and firewall protections, exposing internal LAN devices to the public internet. Because the Calix router is typically provisioned with its default UPnP-enabled configuration, this issue poses significant risk to residential users with network-connected internal devices such as security cameras, network-attached storage (NAS), and other IoT appliances.\r\n\r\n### Solution\r\nUnfortunately, the CERT/CC was unable to reach Calix to coordinate this vulnerability. Until a vendor patch is available, users can reduce exposure by disabling UPnP on the router’s administrative interface. If the UPnP setting is unavailable or locked, it may be necessary to contact your ISP to request its deactivation at the carrier level. Alternatively, filtering inbound traffic to TCP port 5000, either via the router itself, a secondary firewall, or through your ISP, can prevent external hosts from reaching the `WANIPConnection` service.\r\n\r\n### Acknowledgements\r\nThanks to Brian Khan Quintana for researching and reporting this vulnerability. This document was written by Molly Jaconski.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/756733"},{"url":"https://drkq.github.io/security-research/calix-vu756733/","summary":"https://drkq.github.io/security-research/calix-vu756733/"}],"title":"Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability","tracking":{"current_release_date":"2026-08-21T14:44:16+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.44"}},"id":"VU#756733","initial_release_date":"2026-08-21 14:44:16.794493+00:00","revision_history":[{"date":"2026-08-21T14:44:16+00:00","number":"1.20260821144416.1","summary":"Released on 2026-08-21T14:44:16+00:00"}],"status":"final","version":"1.20260821144416.1"}},"vulnerabilities":[{"title":"A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service.","notes":[{"category":"summary","text":"A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls. A remote attacker can send crafted SOAP requests to add, delete, or enumerate port mappings, or to query the external IP address, without authentication. Successful exploitation may enable bypass of the firewall/NAT boundary and exposure of internal LAN services to the public internet."}],"cve":"CVE-2026-75501","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#756733"}]}],"product_tree":{"branches":[]}}