Description
A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The existence of this vulnerability is still disputed at present. The vendor explains: "We reproduced the reported request pattern. The observed delay results from expected input-timeout handling while the handler waits for input data. We did not observe a backend crash, resource exhaustion, service instability, or loss of EWI availability, and the interface remained accessible during and after testing."
Published: 2026-08-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Assess Impact
AI Analysis

Impact

A flaw exists in Calix GigaSpire firmware 26.1.0 within the utilities_configurationsave.cgi component of the web management interface. Manipulating the sessionKey parameter can trigger a denial of service by causing the handler to delay while waiting for input. This flaw is exploitable remotely; an exploit has been published and may be used. The vendor notes that while the delay occurs, no backend crash, resource exhaustion, or loss of EWI availability was observed during testing. However, the existence of the vulnerability is still disputed.

Affected Systems

The vulnerability affects Calix GigaSpire devices running firmware version 26.1.0. No other product or version information is available.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS is under 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers can remotely trigger the flaw by sending a crafted request to utilities_configurationsave.cgi with a manipulated sessionKey, potentially causing the service to become unavailable. The vendor’s observation that no backend crash or service instability was observed suggests the practical impact may be limited, but the existence of a published exploit requires careful consideration.

Generated by OpenCVE AI on October 17, 2026 at 09:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Obtain and install any vendor-released firmware update that addresses the sessionKey handling issue.
  • If no update is available, limit access to the web management interface to trusted management IP addresses or apply firewall rules to block unauthorized traffic.
  • Monitor device logs for abnormal request patterns to utilities_configurationsave.cgi and apply additional input validation or configuration hardening as possible.

Generated by OpenCVE AI on October 17, 2026 at 09:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The existence of this vulnerability is still disputed at present. The vendor explains: "We reproduced the reported request pattern. The observed delay results from expected input-timeout handling while the handler waits for input data. We did not observe a backend crash, resource exhaustion, service instability, or loss of EWI availability, and the interface remained accessible during and after testing."

Fri, 14 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service
First Time appeared Calix
Calix gigaspire
Weaknesses CWE-404
CPEs cpe:2.3:a:calix:gigaspire:*:*:*:*:*:*:*:*
Vendors & Products Calix
Calix gigaspire
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Calix Gigaspire
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-16T06:04:47.985Z

Reserved: 2026-08-13T14:25:09.687Z

Link: CVE-2026-19745

cve-icon Vulnrichment

Updated: 2026-08-14T16:40:13.642Z

cve-icon NVD

Status : Deferred

Published: 2026-08-13T20:17:21.203

Modified: 2026-10-16T07:17:12.870

Link: CVE-2026-19745

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T09:45:06Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release