A newly disclosed vulnerability in Calix GS7 XGS (GS5239XG) residential gateways allows unauthenticated remote attackers to manipulate port-forwarding rules and bypass NAT protections entirely, exposing devices on the internal network to the open internet. The flaw remains unpatched.

Tracked as CVE-2026-75501, the issue affects devices running EXOS/6.6.47 firmware and stems from the router exposing its MiniUPnPd control endpoint on the WAN interface over TCP port 5000 without any access controls. According to CERT/CC, the device binds its UPnP WANIPConnection SOAP service to the public-facing interface, allowing anyone on the internet to send unauthenticated SOAP requests to the router.

Security researcher Brian Khan Quintana discovered the flaw and attempted to notify Calix directly on June 7, receiving no response. He then escalated the issue to the Carnegie Mellon CERT Coordination Center, which also failed to get a reply from the vendor after multiple attempts, leading to a coordinated public disclosure.

What attackers can do

Using a single unauthenticated request, an attacker can:

  • Create arbitrary port-forwarding rules
  • Delete existing port mappings
  • Enumerate the router’s current mappings
  • Retrieve the device’s public IP address

Quintana verified the issue by sending requests from outside his home network to create a port mapping exposing an internal device. A rule configured with no expiration survived a full power cycle of the router, meaning the exposure is persistent rather than transient.

Calix is a major supplier to U.S. broadband providers, with the affected GS5239XG model (also sold as the GigaSpire 7u10txg) marketed as a premium Wi-Fi 7 gateway with integrated XGS-PON fiber termination. Providers known to work with Calix include Cox Communications, Brightspeed, ALLO, CityFibre, and Conexon, though it is not confirmed which of these have deployed the affected model.

No patch, limited workaround

With no fix currently available, Quintana recommends disabling UPnP through the router’s administrative interface (Advanced, then Security, then UPnP). This blocks automatic port opening used by some games and applications, though specific ports can still be opened manually. CERT/CC notes that the UPnP toggle may be locked on some devices, in which case affected customers should contact their ISP to request it be disabled.

BleepingComputer has contacted Calix for comment on the affected models and patch timeline but had not received a response as of publication.