CVE-2026-75501: Calix EXOS firmware vulnerability
A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls. A remote attacker can send crafted SOAP requests to add, delete, or enumerate port mappings, or to query the external IP address, without authentication. Successful exploitation may enable bypass of the firewall/NAT boundary and exposure of internal LAN services to the public internet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block access to the MiniUPnPd control endpoint on the WAN interface (TCP port 5000) using network controls (e.g., firewall/ACL) because it is exposed without access controls.
Event History
Frequently Asked Questions
Which devices are exposed to internet-based exploitation?
Calix GS7 XGS (GS5239XG) residential routers running the affected Calix EXOS firmware are exposed when the MiniUPnPd WANIPConnection control endpoint is reachable on the WAN interface over TCP port 5000.
What does an attacker need to exploit this issue?
An attacker only needs network access to the router's WAN-facing TCP port 5000. The described SOAP operations do not require authentication or prior access to the local network.
Are default access controls sufficient to prevent exploitation?
No. The endpoint is described as exposed on the WAN interface without access controls, allowing unauthenticated requests to manage or enumerate NAT port mappings.
What can be done if firmware remediation is not immediately available?
Restrict or block WAN access to TCP port 5000 so that remote systems cannot reach the MiniUPnPd control endpoint. This prevents the described unauthenticated SOAP requests from being sent from the public internet.
How can administrators check for exposure?
Verify whether TCP port 5000 is reachable on the router's WAN address and whether it serves the UPnP WANIPConnection control endpoint. Exposure is indicated if unauthenticated SOAP requests can query the external IP address or enumerate, add, or delete port mappings.