Unpatched Calix GS7 XGS Router CVE Lets Attackers Bypass NAT and Expose Internal Devices

An unpatched vulnerability in Calix GS7 XGS residential routers allows remote attackers to bypass NAT and firewall protections and expose internal network devices to the public internet. The flaw, tracked as CVE-2026-75501, affects routers running EXOS/6.6.47 firmware and has no patch available.

What Happened: Calix Router UPnP NAT Bypass Exposes Home Networks

Security researcher Brian Khan Quintana discovered a missing authentication vulnerability in Calix GS7 XGS (GS5239XG) residential routers. The flaw exposes the MiniUPnPd control endpoint on the WAN interface over TCP port 5000 without any access controls.

Consequently, anyone on the internet can send unauthenticated SOAP requests to create, delete, or enumerate port-forwarding rules on affected devices. This effectively dismantles the router’s NAT and firewall boundary, leaving cameras, NAS devices, admin interfaces, and IoT appliances exposed.

Technical Details of the Calix GS7 XGS Vulnerability

CVE-2026-75501 is a missing authentication issue in the UPnP WANIPConnection service. In affected firmware versions, the router binds its MiniUPnPd SOAP service to the public WAN interface on TCP port 5000. No authentication or session validation is enforced.

Therefore, an attacker can craft a single HTTP POST request containing a SOAP envelope that instructs the router to forward a public port to an internal IP address and port. The port-forwarding rule persists across reboots if configured with no expiration. The attacker does not need to be on the same network, have a password, or have prior access to the device.

An attacker exploiting this issue can perform the following actions:

• Create arbitrary port-forwarding rules from any public port to any internal address
• Delete existing port mappings
• Enumerate the router’s current NAT mappings
• Retrieve the router’s public IP address

Quintana confirmed the vulnerability through a proof-of-concept request sent from outside his home network. The port mapping he created remained active even after power-cycling the router.

Business and Operational Impact

The impact of CVE-2026-75501 extends beyond individual households to small businesses and remote workers using the same router hardware. Key consequences include:

• Internal device exposure: Cameras, NAS devices, printers, and IoT appliances become reachable from the public internet
• Administrative interface access: Management panels on internal systems may be exposed to brute-force and exploitation
• Lateral movement risk: An exposed internal device can serve as a foothold for further network compromise
• No vendor patch: Calix has not yet released a firmware fix, and no timeline has been announced

Calix supplies equipment to major U.S. broadband providers including Cox Communications, Brightspeed, ALLO, CityFibre, and Conexon. The affected GS5239XG model is marketed as the GigaSpire 7u10txg, a premium Wi-Fi 7 gateway with integrated XGS-PON fiber terminal.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Disable UPnP on the router through the administrative interface under Advanced → Security → UPnP
2. If the setting is locked by the ISP, contact the provider and request deactivation
3. Manually configure only the specific ports needed for legitimate services
4. Monitor firewall logs for unexpected inbound connection attempts to internal devices

Additional Network Hardening Steps

Furthermore, network administrators and home users should implement the following additional controls:

• Segment IoT devices onto a separate VLAN or guest network
• Disable remote management interfaces on internal devices
• Apply firmware updates immediately when Calix releases a patch
• Use endpoint monitoring to detect unusual inbound traffic patterns

Bottom line: Until Calix releases a firmware patch, disabling UPnP is the only reliable way to prevent remote attackers from punching holes through the router’s firewall. Contact your ISP if the setting is locked.

Incident Summary

CVE ID / Incident:	CVE-2026-75501
Affected Systems:	Calix GS7 XGS (GS5239XG / GigaSpire 7u10txg) routers running EXOS/6.6.47 firmware
Disclosure Date:	August 24, 2026
Patch Status:	No patch available

References

1. BleepingComputer, “Unpatched Calix flaw lets hackers bypass NAT to expose internal devices,” August 24, 2026, https://www.bleepingcomputer.com/news/security/unpatched-calix-flaw-lets-hackers-bypass-nat-to-expose-internal-devices/, accessed August 25, 2026.
2. CERT/CC Vulnerability Note VU#756733, “Calix GS7 XGS GS5239XG residential router contains a missing authentication vulnerability,” https://kb.cert.org/vuls/id/756733, accessed August 25, 2026.
3. NVD, “CVE-2026-75501 Detail,” National Institute of Standards and Technology, https://nvd.nist.gov/vuln/detail/CVE-2026-75501, accessed August 25, 2026.
4. Brian Khan Quintana, “CVE-2026-75501: Calix GS7 XGS UPnP WANIPConnection Authentication Bypass,” https://drkq.github.io/security-research/calix-vu756733/, accessed August 25, 2026.