A flaw in an unidentified function of the traceroute.cmd file in Calix GigaSpire 26.1.0 allows an attacker to trigger a denial of service. The description explicitly states the attack may be initiated remotely, indicating remote exploitability. It is a moderate severity flaw, with a CVSS score of 5.3, and is categorized as CWE‑404 – Improper Handling of Unspecified or Unknown Error. The impact is a loss of service availability for the affected device; no compromise of confidentiality or integrity has been reported, and we infer that the vulnerability does not impact these vectors.

Devices running Calix GigaSpire firmware version 26.1.0 are affected. The issue is confined to the traceroute.cmd component of the firmware package shipped by Calix. No other versions or model variants are listed as vulnerable.

The CVSS score indicates moderate risk; however, the EPSS score of < 1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The description explicitly states a remote attack vector, confirming remote exploitation is possible. Successful execution would lead to service interruption of the GigaSpire unit, which could affect network availability for customers relying on that device, but vendor testing did not observe forced logout or loss of EWI availability. No known mitigations or patch releases are yet available from the vendor.