Vulnerability in Calix routers exposes home devices to the entire internet

Security researcher Brian Han Quintana has discovered a critical vulnerability in Calix GS7 XGS home routers (model GS5239XG), which are used by several major U.S. internet providers — Cox Communications, Brightspeed, ALLO, CityFibre and Conexon. The device is also sold under the name GigaSpire 7u10txg: a premium gateway with Wi-Fi 7 and a built-in XGS-PON optical network terminal.

What's the problem

The vulnerability, assigned the identifier CVE-2026-75501, stems from the fact that the EXOS/6.6.47 firmware exposes the management interface of the MiniUPnPd service to the outside — on the WAN interface, on TCP port 5000 — and does so without any access control whatsoever. According to an advisory from the CERT/CC coordination center at Carnegie Mellon University, the router binds the UPnP WANIPConnection SOAP service to the public interface.

As a result, any attacker on the internet can send the device unauthenticated SOAP requests: adding, deleting and listing port-forwarding rules, as well as learning the router's external IP address. This makes it possible to bypass NAT and the firewall and expose internal cameras, network-attached storage (NAS), admin panels and other “smart home” devices.

“A single unauthenticated request from anywhere in the world is enough to punch a permanent hole in the router's firewall to any device in the house. No password. No prompt. Nothing on the screen. The rule survives a reboot,” Quintana says of the problem's essence. During testing he sent a request from outside his home network, created a forwarding rule with no expiration — and it remained active even after the power was cut.

No patch

The disclosure timeline is telling. Quintana tried to reach the manufacturer as early as June 7, but received no response. After several unsuccessful attempts, he passed the information to CERT/CC, which coordinated the public disclosure; the researcher published the technical details himself. As of this article's publication, Calix has still not responded to the inquiries, and no fix exists.

In the absence of a patch, the only defense is to disable UPnP through the admin interface (Advanced → Security → UPnP). This will deprive the router of the automatic port opening that some games rely on, but the necessary ports can always be forwarded manually. CERT/CC notes that in some cases the setting may be locked — in which case users should contact their provider and ask to have the feature disabled.

Source: Bleeping Computer