“One unauthenticated request from anywhere in the world is enough to open a permanent hole through the router's firewall to any device inside the house. No password. No prompt. Nothing on screen. The rule survives a reboot,” said security researcher Brian Khan Quintana.
CVE-2026-75501: missing authentication on EXOS/6.6.47
The vulnerability, tracked as CVE-2026-75501, stems from a missing authentication check in devices running EXOS/6.6.47 firmware. CERT/CC reports the routers expose the MiniUPnPd control endpoint on the WAN interface on TCP port 5000. In affected firmware versions, the router binds its UPnP WANIPConnection SOAP service to the public WAN interface on TCP port 5000, allowing unauthenticated SOAP requests from the internet.
CERT/CC warns those unauthenticated requests may be used to add, delete, or enumerate port mappings, or to query the router’s external IP address. Quintana demonstrated that an attacker on the public web can therefore bypass NAT and firewall protections to expose internal devices directly to the internet.
Calix GS5239XG / GigaSpire 7u10txg: where the risk lives
The specific model named in the advisory is the Calix GS5239XG, which Calix also markets as the GigaSpire 7u10txg. The device is described as a new, premium gateway that combines Wi‑Fi 7 capability with an integrated XGS‑PON fiber terminal. Calix is identified as a significant vendor in the U.S. broadband-provider market and works with providers including Cox Communications, Brightspeed, ALLO, CityFibre, and Conexon.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogWhat an attacker can do — and what Quintana tested
Quintana documented and tested practical exploitation by sending requests from outside his home network. He successfully created a port mapping that forwarded a public port to an internal address; a mapping configured with no expiration persisted after a power cycle. The researcher lists the specific capabilities an attacker would have against a vulnerable router:
- Create arbitrary port-forwarding rules
- Delete existing mappings
- Enumerate the router’s current mappings
- Retrieve the router’s public IP address
Because such mappings can expose internal cameras, network-attached storage (NAS) devices, administrative interfaces, and IoT appliances, the practical consequence is full exposure of devices that normally sit behind NAT and a firewall.
Discovery, disclosure, and the vendor response
Quintana discovered the vulnerability and attempted to notify the vendor on June 7 but reports no successful contact. He then reported the issue to the Carnegie Mellon CERT Coordination Center (CERT/CC). After multiple attempts to reach the vendor and receiving no response, CERT/CC coordinated a public disclosure and Quintana published the technical details.
BleepingComputer contacted Calix for comment about the flaw, the impacted models, and whether a patch will be released, but had not received a reply as of publishing.
Mitigation now — and the remaining questions
There is no patch available for CVE-2026-75501 in the published record. Quintana recommends that users of affected devices disable UPnP through the administrative interface (Advanced → Security → UPnP). He notes that this disables automatic port opening, which some games rely on, but that specific ports can still be opened manually.
CERT/CC adds an important operational caveat: the UPnP setting might be locked on some devices. Users who cannot change the setting themselves are advised to contact their ISP to request deactivation.
Absent a vendor-issued patch and with major providers in the Calix customer list, the immediate practical defense hinges on configuration changes and ISP cooperation. Whether Calix will issue firmware that removes the MiniUPnPd control endpoint from the WAN interface, hardens authentication, or otherwise mitigates the issue remains an open question in the public record.
