An unpatched vulnerability has been discovered in Calix GS7 XGS (GS5239XG) residential routers widely deployed by U.S. broadband providers. The flaw allows remote, unauthenticated attackers to create arbitrary port-forwarding rules, effectively bypassing Network Address Translation (NAT) protections. This exposure can make internal network devices publicly accessible from the internet without any user interaction or authentication required. The vulnerability poses significant risk to home and small business users relying on these routers for network segmentation and security. As of the article's publication, no patch has been released by Calix to address the issue. Multiple broadband providers distributing these devices could have a large number of affected customers. The ability to expose internal devices could facilitate further attacks including lateral movement, data exfiltration, or device compromise.
An unpatched missing authentication vulnerability (CVE-2026-75501) affects Calix GS7 XGS (GS5239XG) residential routers running EXOS/6.6.47 firmware. The flaw exists because the device exposes the MiniUPnPd control endpoint (WANIPConnection SOAP service) on the WAN (public) interface on TCP port 5000 without any access controls. This allows any remote, unauthenticated attacker on the public internet to send SOAP requests to: create arbitrary port-forwarding rules, delete existing port mappings, enumerate current port mappings, and retrieve the router's public IP address. By exploiting this, an attacker can bypass the router's NAT and firewall protections to expose internal devices such as cameras, NAS devices, administrative interfaces, and IoT appliances to the public internet. Port mappings created with no expiration persist across reboots. No authentication, password, or on-screen prompt is required. Security researcher Brian Khan Quintana discovered the flaw and reported it to CERT/CC after the vendor failed to respond to initial disclosure attempts on June 7.
1. Disable UPnP on the affected router via the administrative interface: Advanced → Security → UPnP. This prevents unauthenticated port-forwarding rule creation but disables automatic port opening (games and some applications may require manual port configuration instead). 2. If the UPnP setting is locked or inaccessible in the admin interface, contact your ISP (broadband provider) to request deactivation of UPnP on the device. 3. Manually configure only necessary port forwarding rules rather than relying on UPnP. 4. Monitor for any unauthorized or unexpected port-forwarding rules on your router. 5. Await an official patch from Calix; no fix has been released as of the article's publication date.
TCP port 5000 (WAN-facing UPnP/MiniUPnPd SOAP endpoint on affected Calix routers), Unauthenticated SOAP requests to WANIPConnection service on TCP port 5000
