CVE-2026-75501: Calix EXOS UPnP Auth Bypass Vulnerability

CVE-2026-75501 Overview

CVE-2026-75501 affects the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router. The device exposes the MiniUPnPd control endpoint on the WAN interface via TCP port 5000 without access controls. Unauthenticated remote attackers can send crafted Simple Object Access Protocol (SOAP) requests to the Universal Plug and Play (UPnP) WANIPConnection service to add, delete, or enumerate Network Address Translation (NAT) port mappings. Attackers can also query the external IP address. Successful exploitation bypasses the firewall/NAT boundary and exposes internal LAN services to the public internet. The weakness is classified as Missing Authentication for Critical Function [CWE-306].

Critical Impact
Remote unauthenticated attackers can rewrite NAT port-forwarding rules from the internet, exposing arbitrary internal LAN services and pivoting into the home network.

Affected Products

Calix EXOS firmware
Calix GS7 XGS residential router
Calix GS5239XG hardware model

Discovery Timeline

2026-08-21 - CVE-2026-75501 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-75501

Vulnerability Analysis

The Calix EXOS firmware ships MiniUPnPd bound to the WAN interface on TCP port 5000 with no authentication or access control list. UPnP is intended to serve LAN clients on the internal interface only. Exposing the WANIPConnection service on the WAN side allows any internet host to invoke privileged control actions. An attacker can issue standard SOAP actions such as AddPortMapping, DeletePortMapping, GetGenericPortMappingEntry, and GetExternalIPAddress to control the router's NAT table.

The integrity impact is high because attackers can inject arbitrary port-forwarding rules that redirect inbound WAN traffic to internal LAN hosts. Attackers can expose services such as Remote Desktop Protocol (RDP), Server Message Block (SMB), and Internet of Things (IoT) management interfaces that residents assume are protected by NAT. External IP discovery via GetExternalIPAddress also aids reconnaissance and mass-scanning campaigns targeting home routers.

Root Cause

The root cause is a missing authentication check on a critical function. MiniUPnPd is configured to listen on the WAN-side interface, and no source-address filtering, credential requirement, or firewall rule blocks unsolicited internet traffic to TCP port 5000. UPnP was not designed for exposure beyond a trusted LAN segment.

Attack Vector

Exploitation requires only network access to the router's public IP address. An attacker sends an HTTP POST containing a SOAP envelope with a UPnP action (for example u:AddPortMapping) targeting /ctl/IPConn or the equivalent control URL. The device parses the request and modifies its iptables NAT rules. No user interaction, credentials, or privileges are required. See the Calix VU#756733 research writeup and the CERT/CC Vulnerability Note VU#756733 for protocol-level details.

Detection Methods for CVE-2026-75501

Indicators of Compromise

Inbound TCP connections to port 5000 on the router's WAN interface from external IP addresses.
SOAP requests containing AddPortMapping, DeletePortMapping, or GetExternalIPAddress in the HTTP body received from non-LAN sources.
Unexpected NAT port-forwarding entries in the router configuration that were not created by an administrator.
New inbound sessions to internal LAN hosts on services (RDP, SSH, SMB, HTTP administration panels) that were not previously reachable from the internet.

Detection Strategies

Scan the router's WAN IP for an open TCP 5000 listener and validate whether it responds to a benign GetExternalIPAddress SOAP action.
Review router logs and NAT tables for port-forwarding rules that lack a matching administrative change ticket.
Correlate perimeter netflow with the router's declared port-forwarding policy to identify unauthorized inbound exposure.

Monitoring Recommendations

Monitor upstream network telemetry for inbound traffic to TCP 5000 destined for consumer premises equipment.
Alert on HTTP requests containing the SOAPAction header referencing urn:schemas-upnp-org:service:WANIPConnection sourced from WAN interfaces.
Baseline the expected set of port-forwarding rules and alert on any additions, deletions, or changes.

How to Mitigate CVE-2026-75501

Immediate Actions Required

Block inbound traffic to TCP port 5000 on the WAN interface at the upstream provider edge or transit device.
Disable UPnP on the Calix GS7 XGS device if the administrative interface exposes that option.
Audit all existing NAT port-forwarding rules and remove entries that cannot be attributed to a legitimate administrator.
Contact Calix support for firmware guidance specific to the GS5239XG platform.

Patch Information

No vendor patch link is referenced in the NVD entry at publication. Operators should consult the CERT/CC Vulnerability Note VU#756733 for coordinated vendor status updates and apply Calix firmware updates as soon as they become available.

Workarounds

Restrict access to TCP port 5000 on the WAN interface using upstream Access Control Lists (ACLs) until a firmware fix is deployed.
Where feasible, replace or bridge the affected device behind a firewall that blocks unsolicited inbound traffic to all router management and UPnP ports.
Segment high-value LAN assets so that exploitation of the NAT boundary does not directly expose sensitive services.

bash

# Example upstream ACL concept to drop inbound UPnP traffic to the router WAN
# Applied on an upstream router or firewall facing the internet
iptables -A FORWARD -p tcp --dport 5000 -d <router-wan-ip> -j DROP
iptables -A INPUT   -p tcp --dport 5000 -j DROP