CVE-2026-75501 in EXOS
Summary
by MITRE • 08/21/2026
A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls. A remote attacker can send crafted SOAP requests to add, delete, or enumerate port mappings, or to query the external IP address, without authentication. Successful exploitation may enable bypass of the firewall/NAT boundary and exposure of internal LAN services to the public internet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The Calix EXOS firmware for the GS7 XGS residential router contains a critical security flaw within its Universal Plug and Play implementation that allows unauthenticated remote attackers to manipulate network address translation configurations. This vulnerability stems from the improper configuration of the MiniUPnPd control endpoint, which is exposed on the Wide Area Network interface via TCP port 5000 without any form of access control or authentication mechanism. In a properly secured environment, UPnP services should either be disabled entirely for WAN-facing interfaces or restricted to local network segments only, as they are inherently designed for trusted internal networks where devices can self-configure their connectivity needs. By exposing this service on the public internet, the device effectively removes the primary barrier that prevents external actors from interacting with its NAT and firewall rules directly through standard UPnP protocols.
The technical nature of this flaw involves the acceptance and execution of crafted SOAP requests sent to the WANIPConnection control point. An attacker can interact with this endpoint to perform several dangerous operations including adding new port forwarding entries, deleting existing ones, enumerating current mappings, or querying the device's external IP address. Because there is no authentication required for these actions, any entity on the internet that can reach TCP port 5000 on the router's public interface can execute these commands with full administrative privileges over the NAT configuration. This lack of authorization checks violates fundamental security principles regarding privilege management and access control, allowing a remote user to effectively rewrite how traffic is routed between the internal local area network and the external internet without any verification of identity or intent.
The operational impact of this vulnerability is severe, as it enables a complete bypass of the firewall and NAT boundary that typically protects devices on the private LAN segment. By adding port forwarding rules remotely, an attacker can redirect inbound traffic from specific ports directly to internal hosts such as web servers, IoT devices, or workstations that were previously isolated behind the router's default deny-all policy for unsolicited incoming connections. This exposure makes these internal services accessible to the public internet, significantly increasing their attack surface and making them vulnerable to exploitation by other threats like ransomware, botnets, or data exfiltration tools. Furthermore, the ability to delete port mappings can disrupt legitimate network operations, while enumerating existing rules allows attackers to map out the internal network topology and identify high-value targets for subsequent attacks.
This vulnerability aligns with Common Weakness Enumeration categories such as CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Default Credentials or Configuration if default UPnP settings are enabled by design, though in this case it is more accurately classified under CWE-613 Insufficient Session Expiration or simply the broader category of insecure direct object references due to the lack of authentication on a critical management interface. In terms of the MITRE ATT&CK framework, this exploitation technique maps directly to T1098 Exploitation for Privilege Escalation and potentially T1562 Impair Defenses by disabling or modifying security software configurations like firewalls through legitimate system mechanisms. The attack vector is classified as Remote with Low Complexity since it requires no user interaction and can be automated easily using standard network tools, making it a high-risk threat that demands immediate attention from administrators to prevent widespread compromise of residential networks relying on this hardware.
Mitigation strategies should prioritize the immediate disabling of UPnP services on the WAN interface if such functionality is not strictly required for specific legacy applications, which are increasingly rare in modern networking environments. If UPnP must remain enabled for internal network convenience, it is imperative that the configuration be restricted to LAN interfaces only and explicitly disabled or firewalled off from the WAN side. Administrators should also ensure that firmware updates provided by Calix are applied promptly once patches addressing this specific exposure of port 5000 become available. Additionally, implementing strict ingress filtering on any managed network perimeter can help block unauthorized SOAP requests targeting UPnP endpoints, although relying solely on external filters is less effective than correcting the root configuration error within the device itself to ensure that sensitive management interfaces are never exposed to untrusted networks.