A vulnerability in the Calix EXOS firmware for the GS7 XGS

CVE-2026-75501 is a missing-authentication flaw in the Calix GS7 XGS (GS5239XG) residential fiber gateway running firmware EXOS/6.6.47. The router's MiniUPnPd 2.3.7 control endpoint binds to the WAN interface on TCP port 5000 without any access control. Any unauthenticated remote attacker can send SOAP requests to add, delete, or enumerate NAT port-forwarding rules — effectively punching persistent holes through the subscriber's firewall to expose internal LAN devices (cameras, NAS, IoT) to the public internet. The flaw was discovered by researcher Brian Khan Quintana, reported to CERT/CC as VU#756733 after Calix failed to respond to direct disclosure on June 7, and published on August 21, 2026. There is no patch available and no vendor acknowledgment.

There is no vendor CVSS score to compare against, so noisgate is establishing the first assessment. The unauthenticated-remote, zero-click nature of the attack is genuinely nasty — CVSS math alone would push this toward HIGH (≈7.5 AV:N/AC:L/PR:N/UI:N/S:C). However, the actual *impact* is narrower than RCE: the attacker cannot execute code on the router, cannot intercept traffic, and cannot move laterally without a second vulnerability in a LAN device behind the NAT. For enterprise security teams, this is a consumer CPE device outside your asset inventory. The blast radius is per-household, not per-fleet. The practical risk is that remote workers behind affected ISPs (Cox, Brightspeed, ALLO, CityFibre, Conexon) have their home LAN partially exposed — but corporate laptops with host firewalls and VPN/ZTNA remain protected by their own controls.

Why this verdict

• Unauthenticated remote access with zero friction: AV:N/AC:L/PR:N/UI:N — the attack requires only a TCP connection to port 5000. This is the strongest upward factor and prevents a LOW rating.
• No code execution — NAT rule manipulation only: The attacker can create/delete port forwarding rules but cannot execute code on the router, intercept traffic, or directly compromise any device. Impact requires chaining with a separate vulnerability on an internal device.
• Consumer CPE, not enterprise infrastructure: This is a residential fiber gateway deployed by ISPs to home subscribers. Enterprise security teams do not own, manage, or patch these devices. The asset is outside the enterprise perimeter and inventory.
• Role multiplier: The Calix GS7 XGS is a residential ONT/router. It does not occupy any high-value enterprise role (not a DC, hypervisor, PAM, CI/CD, backup, or enterprise network edge appliance). For ISPs, it is CPE — but the vuln grants NAT manipulation, not management-plane access. The blast radius is *per-subscriber-household*, not fleet-scale. The high-value role floor does not apply.
• No patch available, but mitigation exists: UPnP can be disabled via the admin UI (Advanced → Security → UPnP). ISPs can also filter TCP 5000 at the carrier edge. The lack of a patch is a concern but the mitigation is straightforward.

Why not higher?

The vulnerability does not achieve code execution on the router or any downstream device. It only manipulates NAT rules, requiring a separate exploitable service on an internal LAN device for real impact. The affected device is consumer CPE outside enterprise control, and corporate endpoints are independently protected by host firewalls, EDR, and ZTNA. No active exploitation or KEV listing elevates urgency.

Why not lower?

The attack is unauthenticated, remote, zero-click, and trivially exploitable with standard UPnP tooling. Port mappings persist across reboots. There is no vendor patch and no vendor acknowledgment. For enterprises with significant remote workforces on affected ISPs (Cox, Brightspeed), the exposure of home LAN environments — even indirectly — warrants tracking and advisory communication rather than outright dismissal.

1. Issue advisory to remote workers on affected ISPs to disable UPnP — Instruct employees on Cox, Brightspeed, ALLO, CityFibre, and Conexon to navigate to Advanced → Security → UPnP in their router admin panel and disable UPnP. This eliminates the attack surface entirely. Since this is a MEDIUM verdict, there is no mitigation SLA — this falls under the 365-day remediation window, but given the zero-day status, issuing the advisory promptly is prudent.
2. Verify host firewall policy on corporate endpoints — Ensure Windows Firewall / macOS Application Firewall / iptables policies on corporate-managed devices block unsolicited inbound connections on all interfaces, not just public profiles. This ensures that even if a NAT hole is punched to a corporate laptop's LAN IP, no service is reachable.
3. Confirm VPN/ZTNA is enforced for remote access — Corporate resources should only be reachable via VPN or ZTNA — never via direct LAN-routable connections. Validate that split-tunnel configurations don't expose management ports on the LAN interface.
4. Request ISP-level TCP 5000 filtering for managed accounts — If your organization has managed ISP accounts (e.g., corporate-sponsored home broadband), request that the ISP filter inbound TCP 5000 at the carrier edge. This blocks exploitation without requiring end-user action.

Run this from any Linux/macOS workstation (or WSL) against the WAN IP of a suspected Calix GS7 XGS router. No special privileges required. Usage: bash check_cve_2026_75501.sh <WAN_IP>

#!/usr/bin/env bash
# check_cve_2026_75501.sh — Test for CVE-2026-75501 (Calix GS7 XGS UPnP WAN exposure)
# Usage: bash check_cve_2026_75501.sh <WAN_IP>
# Requires: curl
# Exit codes: 0=VULNERABLE, 1=PATCHED/NOT_AFFECTED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <WAN_IP>"
  exit 2
fi

TARGET="$1"
PORT=5000
TIMEOUT=5

# Step 1: Check if TCP 5000 is open
if ! curl -s --connect-timeout "$TIMEOUT" -o /dev/null -w '' "http://${TARGET}:${PORT}/" 2>/dev/null; then
  echo "PATCHED — TCP port ${PORT} is not reachable on ${TARGET}. UPnP endpoint not exposed."
  exit 1
fi

# Step 2: Request UPnP root device description
RESP=$(curl -s --connect-timeout "$TIMEOUT" "http://${TARGET}:${PORT}/rootDesc.xml" 2>/dev/null || true)

if echo "$RESP" | grep -qi 'MiniUPnPd'; then
  echo "VULNERABLE — MiniUPnPd root description found on WAN interface ${TARGET}:${PORT}."
  echo "  Device is exposing UPnP WANIPConnection service to the internet."
  echo "  Recommendation: Disable UPnP via router admin (Advanced > Security > UPnP)."
  exit 0
elif echo "$RESP" | grep -qi 'UPnP\|WANIPConnection\|serviceType'; then
  echo "VULNERABLE — UPnP service descriptors found on WAN interface ${TARGET}:${PORT}."
  exit 0
else
  echo "UNKNOWN — Port ${PORT} is open but UPnP descriptors not recognized. Manual verification needed."
  exit 2
fi

Sources

1. CERT/CC VU#756733 Advisory
2. BleepingComputer — Unpatched Calix flaw lets hackers bypass NAT
3. NVD — CVE-2026-75501
4. Vista Net Inc — VU#756733 Repost
5. KSEC Community Forum — Calix Discussion
6. Calix Wi-Fi 7 Platform Press Release
7. CISA KEV Catalog