As reported by BleepingComputer, an unpatched vulnerability in Calix GS5239XG residential gateways exposes the UPnP WANIPConnection SOAP service on the public WAN interface — TCP port 5000 — with zero authentication. The result is that any internet-connected attacker can create persistent port-forwarding rules through a victim's router, silently exposing internal cameras, NAS devices, admin interfaces, and IoT systems to the world.
Vulnerability Summary
| Field | Detail |
|---|---|
| CVE | CVE-2026-75501 |
| Severity | Critical (unauthenticated, remote, no user interaction, firewall bypass) |
| Affected Product | Calix GS5239XG (marketed as GigaSpire 7u10txg / GS7 XGS) |
| Affected Firmware | EXOS/6.6.47 |
| Vendor | Calix |
| Patch Available | No — vendor unresponsive to researcher and CERT/CC coordination |
| Active Exploitation | Not confirmed; full technical details and PoC publicly disclosed |
| Attack Vector | Remote, unauthenticated SOAP requests to WAN-facing UPnP endpoint (TCP 5000) |
Why This Matters More Than a Typical Router Bug
This isn't just another SOHO router vulnerability. The affected device is a premium Wi-Fi 7 gateway with an integrated XGS-PON fiber terminal, deployed at scale through major U.S. broadband providers including Cox Communications, Brightspeed, ALLO, CityFibre, and Conexon. The deployment model is the critical factor here: these are ISP-managed CPE devices. The end subscriber cannot patch the firmware, cannot disable the vulnerable service through any exposed UI, and in many cases cannot even access administrative controls. The responsibility chain runs entirely through the ISP and Calix.
The researcher confirmed that port mappings created via the exploit survive a power cycle. This is not a transient exposure — it's a permanent hole punched through the firewall that persists across reboots until manually discovered and removed.
The UPnP-on-WAN Problem Class
Binding a UPnP control endpoint to the WAN interface is a well-known antipattern. UPnP IGD was designed for LAN-side auto-configuration, not external manipulation. When MiniUPnPd (or any UPnP daemon) listens on the public interface without authentication, it effectively turns the router into a publicly programmable port-forwarding appliance. This specific misconfiguration has bitten vendors before, but the scale of this deployment — and the vendor's silence — elevates the risk profile significantly.
Who Is at Risk
Broader Implications
Calix's failure to respond to both the original researcher report (June 7) and subsequent CERT/CC coordination raises serious questions about vulnerability response practices in the ISP equipment supply chain. When a vendor controls firmware across millions of subscriber devices and goes silent on a critical, remotely exploitable flaw, the coordination burden shifts entirely to ISPs — many of whom may lack visibility into which subscribers are running the affected firmware. This is a systemic risk in managed CPE models.
Shield53 Recommendations
Immediate Actions
- For affected ISP customers: Contact your broadband provider's support and explicitly request a firmware update or device swap. Reference CVE-2026-75501. If you run internal services (cameras, NAS, admin panels), assume they may already be exposed — check for unexpected port mappings via the router's local management interface if accessible.
- For ISPs deploying Calix gear: Audit your fleet for GS5239XG devices running EXOS/6.6.47. Push a firmware update or configuration change that binds the UPnP daemon exclusively to the LAN interface. If Calix has not provided a patch, demand one — and consider interim network-level mitigations such as filtering inbound TCP 5000 at the OLT or aggregation layer.
- For enterprise security teams: Update remote worker risk assessments. Employees on affected ISP gear may have internal home services exposed to the internet, creating lateral movement opportunities. Consider requiring VPN-only access from home networks and deploying endpoint detection on corporate-managed devices regardless of location.
- Detection: Monitor perimeter logs for inbound connections to TCP port 5000 on residential IP ranges associated with affected ISPs. Internally, scan for unexpected port-forwarding entries on managed CPE. Threat hunt for SOAP requests targeting
/UPnP/orWANIPConnectionpaths originating from external IPs. - Network-level mitigation (if router admin access is available): Block inbound TCP 5000 at the WAN interface via firewall rules. Disable UPnP entirely if LAN-side auto-configuration is not required. This may break some consumer applications that rely on automatic port mapping but eliminates the attack surface.
The combination of unpatched firmware, ISP-controlled updates, and public proof-of-concept code creates a window of exposure that could last months. Organizations should treat affected home networks as untrusted until ISPs confirm remediation.
