An unpatched vulnerability in **Calix GS7 XGS (GS5239XG)** residential routers, widely deployed by U.S. broadband providers, is allowing remote, unauthenticated attackers to create port-forwarding rules. This critical flaw can expose local network devices directly to the public internet. The vulnerability, identified as **CVE-2026-75501**, is described as a missing authentication issue. It specifically impacts devices running **EXOS/6.6.47** firmware. ### Discovery and Disclosure Security researcher **Brian Khan Quintana** initially discovered the flaw. After unsuccessful attempts to notify the vendor on June 7, he reported the vulnerability to the **Carnegie Mellon CERT Coordination Center (CERT/CC)**. Following multiple unacknowledged attempts to contact **Calix**, **CERT/CC** coordinated a public disclosure, prompting Quintana to release technical details. ### Widespread Impact **Calix** is a significant vendor in the U.S. broadband market, supplying major entities such as **Cox Communications**, **Brightspeed**, **ALLO**, **CityFibre**, and **Conexon**. The affected model, **GS5239XG**, is also marketed as the **GigaSpire 7u10txg**, a premium gateway device featuring Wi-Fi 7 capabilities and an integrated XGS-PON fiber terminal. ### Technical Details of CVE-2026-75501 The **CVE-2026-75501** vulnerability stems from the device exposing the "MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls." **CERT/CC** warns, "In affected firmware versions, the router binds its UPnP WANIPConnection SOAP service to the public WAN interface on TCP port 5000." This configuration enables an attacker on the public internet to send unauthenticated SOAP requests to the device. Such requests can be used to add, delete, or enumerate port mappings, or to query the external IP address. This effectively allows attackers to bypass the router's Network Address Translation (NAT) and firewall protections, exposing internal devices like cameras, Network-Attached Storage (NAS), administrative interfaces, and IoT appliances. "One unauthenticated request from anywhere in the world is enough to open a permanent hole through the router's firewall to any device inside the house. No password. No prompt. Nothing on screen. The rule survives a reboot," Quintana stated. ### Attacker Capabilities Quintana's research indicates that an attacker leveraging this security flaw could: * Create arbitrary port-forwarding rules * Delete existing mappings * Enumerate the router’s current mappings * Retrieve its public IP address During testing, Quintana successfully created a port mapping from outside his home network, exposing an internal address. The mapping, configured without an expiration, remained active even after the router was power-cycled. This demonstrates that anyone on the internet can instruct vulnerable **Calix** routers to forward traffic from a public-facing port to a chosen device on the home network.  ### Mitigation Recommendations As there is currently no patch available for **CVE-2026-75501**, Quintana strongly recommends that users of the vulnerable device disable **UPnP** through the administrative interface (found under ***Advanced → Security → UPnP***). While this workaround disables automatic port opening—a feature some games rely on—users can still manually open specific ports as needed. **CERT/CC** also noted that this setting might be locked in certain cases. Users unable to change it should contact their Internet Service Provider (ISP) to request **UPnP** deactivation. **Ghost Protocol** has reached out to **Calix** for comment regarding the flaw, affected device models, and potential patch timelines but has not received a response as of publication.