CVE-2026-75501

Unauthenticated Remote Modification of NAT Port‑Forwarding via UPnP on Calix GS7 XGS Router

View on CVE.org
Published Aug 21, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
Vendor could not replicate the vul, and reporter is unavailable to comment.

Analysis

Vendor could not replicate the vul, and reporter is unavailable to comment.

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
References

No reference.

History
Type Values Removed Values Added
Title CVE-2026-75501 Unauthenticated Remote Modification of NAT Port‑Forwarding via UPnP on Calix GS7 XGS Router
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls. A remote attacker can send crafted SOAP requests to add, delete, or enumerate port mappings, or to query the external IP address, without authentication. Successful exploitation may enable bypass of the firewall/NAT boundary and exposure of internal LAN services to the public internet. Vendor could not replicate the vul, and reporter is unavailable to comment.
Type Values Removed Values Added
Weaknesses CWE-306
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Calix
Calix gs7 Xgs (gs5239xg)
Vendors & Products Calix
Calix gs7 Xgs (gs5239xg)
Type Values Removed Values Added
Weaknesses CWE-276
CWE-284
Type Values Removed Values Added
References
Type Values Removed Values Added
Description A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls. A remote attacker can send crafted SOAP requests to add, delete, or enumerate port mappings, or to query the external IP address, without authentication. Successful exploitation may enable bypass of the firewall/NAT boundary and exposure of internal LAN services to the public internet.
Title CVE-2026-75501
References
Earlier changes (2)
Weaknesses
  • CWE-276

    Incorrect Default Permissions

  • CWE-284

    Improper Access Control

  • CWE-306

    Missing Authentication for Critical Function

Sources

Status
REJECTED
Assigner
certcc
Published
Updated
Sep 15, 2026, 7:44 PM
Reserved
Aug 17, 2026, 8:36 PM

View source JSON

Updated

JSON

Status
Rejected
Published
Aug 21, 2026, 3:16 PM
Modified
Sep 15, 2026, 8:17 PM

View source JSON

No data.

No data.