Calix fiber gateway takes port-forward orders from anyone, and the vendor has not answered
CVE-2026-75501 puts an unauthenticated UPnP control endpoint on the WAN side of a premium ISP gateway. With no patch and no vendor reply, the carriers own the mitigation.
The Watch · Security desk
What happened
- CVE-2026-75501, a missing-authentication bug in Calix GS7 XGS (GS5239XG) routers, lets remote unauthenticated attackers create port-forwarding rules. There is no patch.
- Calix supplies US broadband providers including Cox Communications, Brightspeed, ALLO, CityFibre and Conexon.
- Researcher Brian Khan Quintana tried the vendor on June 7, got nowhere, and took the report to Carnegie Mellon's CERT Coordination Center, which coordinated disclosure.
- In testing from outside his own network, a mapping created with no expiration was still active after the router was power-cycled.
- The recommended step is turning off UPnP in the gateway's admin interface, since no fix exists.
Why it matters
- Who's exposed exposure Cameras, NAS boxes, admin panels and IoT gear behind these gateways become addressable from the public internet without anyone touching the subscriber's credentials.
- What it limits constraint Where the carrier has locked the UPnP control, the household cannot act at all, so every fix becomes a support ticket the ISP has to service one line at a time.
- Who has to decide decision Providers now choose between filtering inbound TCP 5000 at their own edge and waiting on firmware from a vendor that has not spoken.
- What it sets up precedent A CERT/CC-coordinated release with no accompanying vendor statement teaches the next finder that the carrier, not the manufacturer, is the address worth writing to.
Next story · Build · 9h ago
Zenity Labs: one prompt to a public AgentCore agent could return temporary credentials tied to a default role not scoped to that agentConfirmed3 publishers
MiniUPnPd is built to take orders from the inside. The Internet Gateway Device profile exists so that a console or a client on the LAN can ask the router to open a port for itself, and the daemon complies because the request arrived on an interface the router treats as its own. On the GS5239XG running EXOS/6.6.47 firmware, CERT/CC says that WANIPConnection SOAP service is bound to the public WAN interface on TCP port 5000 with no access controls [2][3]. Authentication was never part of that design. The interface it listened on was the control, and that control is what went missing.
The verb list is what lifts this above nuisance. Unauthenticated requests can add port mappings, delete existing ones, enumerate what is already configured, and ask the router for its external IP address [4]. Enumeration and deletion are the parts that get skipped in summaries: an attacker who can read the mapping table learns what the household has already chosen to expose, and one who can delete entries can break a service the subscriber depends on without ever touching a device inside.
The researcher's own framing is worth quoting because it names the operational property that matters: "One unauthenticated request from anywhere in the world is enough to open a permanent hole through the router's firewall to any device inside the house. No password. No prompt. Nothing on screen. The rule survives a reboot" [7].
Inventory is the first place this gets awkward. The affected model is sold as the GS5239XG and also marketed as the GigaSpire 7u10txg, a new premium unit pairing Wi-Fi 7 with an integrated XGS-PON terminal [15]. Any asset search keyed to one of those two strings will undercount the fleet, and support records for carrier-supplied CPE rarely agree on which name got typed [17].
Then the mitigation. The advice on offer is to switch off UPnP in the gateway's administrative interface under Advanced then Security then UPnP, which also turns off automatic port opening for games that expect it, though specific ports can still be forwarded by hand [8][9]. CERT/CC adds that the setting is sometimes locked, in which case the subscriber is told to ask their ISP to disable it [10]. That is the whole subscriber-side toolkit, and on a locked unit it is empty [16]. What remains is upstream: the vulnerable service is reachable as inbound TCP 5000 on the WAN, so filtering that port at the edge removes reachability without a firmware change [18]. That is a decision only Cox, Brightspeed, ALLO and the rest can make, and it is the only one currently available.
What to watch
- A Calix advisory or an EXOS build past 6.6.47 that closes the WAN-side listener, and whether it arrives as a carrier push or a subscriber download.
- Any confirmation from Cox, Brightspeed or ALLO that inbound TCP 5000 is filtered at their edge, or that the UPnP toggle has been unlocked for subscribers.
- Internet-wide scan counts for gateways answering SOAP on port 5000, which would turn an unknown installed base into a countable one.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
An unpatched vulnerability tracked as CVE-2026-75501, a missing authentication issue in Calix GS7 XGS (GS5239XG) residential routers used by multiple U.S. broadband providers, allows remote unauthenticated attackers to create port-forwarding rules that expose local network devices to the public internet.
- [2]
CVE-2026-75501 affects devices running EXOS/6.6.47 firmware.
- [3]
CERT/CC states the device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls, binding its UPnP WANIPConnection SOAP service to the public WAN interface.
- [4]
An attacker on the public internet can send unauthenticated SOAP requests to add, delete, or enumerate port mappings, or to query the external IP address.
- [5]
Calix works with US broadband providers including Cox Communications, Brightspeed, ALLO, CityFibre and Conexon.
- [6]
Quintana tested the flaw by sending requests from outside his home network to create a port mapping exposing an internal address; a mapping configured with no expiration remained active after the router was power-cycled.
- [7]
Quintana: "One unauthenticated request from anywhere in the world is enough to open a permanent hole through the router's firewall to any device inside the house. No password. No prompt. Nothing on screen. The rule survives a reboot."
- [8]
With no fix available for CVE-2026-75501, Quintana recommends users disable UPnP through the administrative interface at Advanced then Security then UPnP.
- [9]
The workaround disables automatic port opening that some games rely on, but specific ports can still be opened manually.
- [10]
CERT/CC notes the UPnP setting might be locked in some cases, and users who cannot change it should contact their ISP to request deactivation.
- [11]
BleepingComputer contacted Calix about the flaw, the affected models and whether a patch will be released, and had received no reply as of publication.
- [12]
The flaw lets attackers bypass the router's NAT and firewall protections and expose internal cameras, network-attached storage devices, administrative interfaces and IoT appliances.
- [13]
Security researcher Brian Khan Quintana discovered the flaw, tried to notify the vendor on June 7 without success, and reported it to the Carnegie Mellon CERT Coordination Center.
- [14]
After multiple attempts to contact the vendor produced no response, CERT/CC coordinated a public disclosure and Quintana published the technical details.
- [15]
The affected model GS5239XG is also marketed as the GigaSpire 7u10txg, a new premium gateway that combines Wi-Fi 7 with an integrated XGS-PON fiber terminal.
- [16]
On units where the ISP has locked the UPnP setting, the subscriber has no mitigation they can apply themselves, because the toggle is the only subscriber-side workaround on offer.
- [17]
The unit carries two commercial names, so an asset or support search keyed to only one of them will undercount the affected fleet.
- [18]
Because the vulnerable service is reachable only as inbound TCP 5000 on the WAN interface, upstream filtering of inbound TCP 5000 removes reachability without any firmware change on the device.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comUnpatched Calix flaw lets hackers bypass NAT to expose internal devices
1 article · August 24, 2026
- scworld.comUnpatched Calix router vulnerability allows remote attackers to expose home networks
1 article · August 25, 2026
Topics and entities
Topics
- ISP customer-premises equipment
- Coordinated Vulnerability Disclosure
Entities
- Cox Communications
- Brian Khan Quintana
- CERT Coordination Center