Calix residential router exposes WAN UPnP controls without authentication
THE BRIEF
CERT/CC says the Calix GS7 XGS GS5239XG running EXOS/6.6.47 binds its UPnP WANIPConnection SOAP service to the public WAN interface on TCP port 5000 without authentication. CVE-2026-75501 permits remote querying and manipulation of NAT port mappings.
WHY IT MATTERS
A router service intended to support automatic port forwarding is reachable from the internet and accepts control requests without authentication. That can change which internal services are exposed through the gateway. The supplied report does not verify exploitation or identify a patch.
WHO SHOULD CARE
ISPs and managed network providers, enterprise remote-work and telecom teams, security operations, and customers using the named router and firmware.
WHAT TO DO NOW
- Inventory Calix GS7 XGS GS5239XG devices and verify whether they run EXOS/6.6.47.
- For affected devices, disable WAN-side UPnP or block unsolicited access to TCP port 5000 where supported, while checking for operational impact.
- Remove unnecessary existing port mappings and review remaining mappings for business or administrative services.
- Obtain and apply provider-approved remediation when available, then verify that the WAN UPnP service no longer accepts unauthenticated requests.
- If a device cannot be remediated promptly, place sensitive work behind an additional trusted access path and avoid relying on the gateway’s automatic port forwarding.
VERIFICATION NOTE
A primary CERT/CC vulnerability record verifies the missing-authentication issue affecting the named Calix router firmware and exposed UPnP service.
