An unpatched vulnerability in Calix GS7 XGS (GS5239XG) residential routers, also marketed as the GigaSpire 7u10txg, allows remote, unauthenticated attackers to create port-forwarding rules that expose internal network devices to the public internet. The flaw, tracked as CVE-2026-75501, is a missing authentication issue affecting devices running EXOS/6.6.47 firmware.
The vulnerability stems from the router exposing its MiniUPnPd control endpoint on the WAN interface via TCP port 5000 without requiring authentication. This means the device binds its UPnP WANIPConnection SOAP service to the public WAN interface, allowing an attacker on the internet to send unauthenticated SOAP requests. These requests can add, delete, or enumerate port mappings, or query the external IP address.
By exploiting this flaw, attackers can bypass the router's Network Address Translation (NAT) and firewall protections. This could expose various internal devices, including cameras, network-attached storage (NAS) devices, administrative interfaces, and IoT appliances, to the public internet. The researcher who discovered the flaw demonstrated that a port mapping configured without an expiration remained active even after the router was power-cycled.
Security researcher Brian Khan Quintana discovered the vulnerability and attempted to notify Calix on June 7. After receiving no response, Quintana reported the issue to the Carnegie Mellon CERT Coordination Center (CERT/CC). Following further unsuccessful attempts by CERT/CC to contact the vendor, a public disclosure was coordinated, and Quintana published technical details.
Calix is a significant vendor for U.S. broadband providers, working with companies such as Cox Communications, Brightspeed, ALLO, CityFibre, and Conexon. The affected GS5239XG model is a new, premium gateway device that integrates Wi-Fi 7 capabilities with an XGS-PON fiber terminal.
The researcher confirmed that a single unauthenticated request from anywhere on the internet is sufficient to open a permanent hole through the router's firewall to any device within the home network, without requiring a password or user prompt. Such a rule persists even after a router reboot.
With no patch currently available for CVE-2026-75501, users of the vulnerable device are advised to disable UPnP through the administrative interface under "Advanced Security > UPnP." While this workaround disables automatic port opening, which some games rely on, specific ports can still be opened manually. CERT/CC notes that this setting might be locked in some cases, in which event users should contact their internet service provider to request deactivation.
Calix has not yet publicly commented on the flaw, the specific device models it impacts, or whether a patch will be released.
