Calix Router Has No-Auth NAT Bypass. Your Firewall Can Be Opened From the Internet
- The Mess: CVE-2026-75501 affects the Calix GS7 XGS (GS5239XG) residential gateway running EXOS/6.6.47. Its UPnP
WANIPConnectionservice is exposed on the public WAN interface over TCP port 5000 without authentication, allowing a remote attacker to create or modify NAT port-forwarding rules.
This is a router.
Its job is to keep the Internet outside.
Instead, an attacker can send it a SOAP request and tell it:
“Forward this port to that machine inside the house.”
No password.
No login.
No confirmation.
The vulnerable MiniUPnPd endpoint exposes the router’s UPnP control interface directly on the WAN side. An attacker can enumerate existing mappings, create new ones, delete them and query the external IP address.
That effectively punches through the NAT/firewall boundary.
And the attacker doesn’t have to be sitting on your Wi-Fi.
They can be on the Internet.
The researcher demonstrated creating a port-forwarding rule to an internal device from outside the home network. Even worse, a mapping configured without an expiration survived a router reboot.
So the attack chain is brutally simple:
Internet → Calix router → unauthenticated UPnP → port forwarding → internal device
- The Damage: An attacker could expose internal cameras, NAS devices, IoT equipment, administration panels or other services to the public Internet without the homeowner realizing anything changed.
That’s what makes this more dangerous than a normal router bug.
The attacker doesn’t necessarily need to compromise the router itself.
They can use it to expose something behind the router.
Maybe a NAS with an outdated web interface.
Maybe an IP camera.
Maybe a home automation system.
Maybe an administration panel that was never designed to face the Internet.
The router becomes the accomplice.
And there is no useful browser warning saying:
“Someone just opened port 8443 to your NAS.”
The researcher also demonstrated that existing port mappings can be enumerated.
That gives an attacker visibility into what the network is already exposing.
The affected hardware is the Calix GS7 XGS / GS5239XG, also marketed as the GigaSpire 7u10txg, running firmware EXOS/6.6.47 or earlier. The device is deployed by multiple broadband providers.
And here comes the ugly part.
There is currently no vendor patch.
CERT/CC was unable to establish coordinated disclosure with Calix, and its current recommendation is to disable UPnP.
- The Fix: Disable UPnP immediately on affected Calix routers; if the setting is locked by your ISP, contact the provider and demand that UPnP be disabled or the vulnerable firmware be replaced.
According to the published guidance, the setting is available under:
Advanced → Security → UPnP
Disabling it prevents automatic port opening.
Some games and applications may stop automatically creating mappings, but specific ports can still be configured manually where necessary.
After disabling UPnP, check your existing port-forwarding rules.
Don’t assume they’re clean.
Look for mappings you didn’t create.
Especially anything pointing toward:
- cameras,
- NAS devices,
- remote administration,
- IoT systems,
- unusual high-numbered ports.
If you find something suspicious, remove it and investigate the destination device.
Because closing the door doesn’t tell you whether somebody already opened a window.
Bugstoday Opinion
This is exactly why “my router has NAT” is not a security strategy.
NAT is useful.
A firewall is useful.
But if an Internet-facing service can modify the firewall’s port-forwarding rules without authentication, you’ve effectively handed someone a remote control for the boundary.
The really nasty part is that the attacker doesn’t need to own the router.
They can simply make the router expose something more interesting.
Bugstoday verdict: a router that accepts unauthenticated UPnP commands from the Internet is not protecting the network the way you think it is. Disable UPnP now. And if your ISP locked the setting, make them fix the damn router.
