Overview

The Calix GS7 XGS GS5239XG router running firmware EXOS/6.6.47 contains a missing authentication vulnerability that exposes its UPnP (Universal Plug and Play) WANIPConnection service on the public WAN interface.

Description

Calix GS7 XGS GS5239XG is a residential gateway that provides routing, NAT, and firewall functionality for home networks. The device includes the Universal Plug and Play (UPnP) service implemented via MiniUPnPd 2.3.7, a lightweight software program that provides features such as automatic port forwarding for applications and devices on the LAN. By default, the UPnP service is exposed on the device’s WAN interface and does not require authentication.

CVE-2026-75501 In affected firmware versions, the router binds its UPnP WANIPConnection SOAP service to the public WAN interface on TCP port 5000. Because the service does not require authentication when accepting SOAP requests, a remote attacker can obtain full access to the router’s critical UPnP functions including adding, deleting, and enumerating NAT port mappings.

Impact

CVE-2026-75501 enables an unauthenticated, remote attacker to remotely query and manipulate existing NAT mappings. By exploiting this vulnerability to create arbitrary port-forwarding rules on the router, an attacker can bypass NAT and firewall protections, exposing internal LAN devices to the public internet. Because the Calix router is typically provisioned with its default UPnP-enabled configuration, this issue poses significant risk to residential users with network-connected internal devices such as security cameras, network-attached storage (NAS), and other IoT appliances.

Solution

Unfortunately, the CERT/CC was unable to reach Calix to coordinate this vulnerability. Until a vendor patch is available, users can reduce exposure by disabling UPnP on the router’s administrative interface. If the UPnP setting is unavailable or locked, it may be necessary to contact your ISP to request its deactivation at the carrier level. Alternatively, filtering inbound traffic to TCP port 5000, either via the router itself, a secondary firewall, or through your ISP, can prevent external hosts from reaching the WANIPConnection service.

Acknowledgements

Thanks to Brian Khan Quintana for researching and reporting this vulnerability. This document was written by Molly Jaconski.

Vendor Information