UPnP exists so that a game console inside your home can ask the router to open a port for it. The entire security model of that protocol rests on one assumption: only devices on the local network can ask.

On the Calix GS5239XG — sold as the GigaSpire 7u10txg — that assumption does not hold.

What the flaw is

CVE-2026-75501 is missing authentication on the MiniUPnPd control endpoint. On firmware EXOS/6.6.47, that endpoint is exposed on the WAN interface, on TCP port 5000, with no access controls.

An unauthenticated SOAP request from the internet can therefore:

  • Create port-forwarding rules
  • Delete existing mappings
  • Enumerate what is currently mapped
  • Retrieve the router's public IP address

Creating a port-forwarding rule from outside means selecting any device inside the home network and publishing it to the internet. The NAT boundary that most household devices depend on for their entire security posture is not bypassed by an exploit — it is reconfigured by asking politely.

Security researcher Brian Khan Quintana demonstrated it by creating permanent forwarding rules from outside his own network. They survived power cycles.

Why the device matters

This is a Wi-Fi 7 residential gateway with an integrated XGS-PON fibre terminal — the box a fibre installer leaves behind, not something a customer chose.

It is deployed by Cox Communications, Brightspeed, ALLO, CityFibre and Conexon.

That changes the shape of the problem completely. A consumer who buys their own router can patch it, replace it, or throw it away. A subscriber with an ISP-supplied gateway usually cannot do any of the three, and in many cases does not have full administrative access to it. The people exposed here are the ones with the fewest options.

The disclosure timeline is the other story

Quintana contacted the vendor on 7 June. He did not get a useful response.

He escalated to the CERT Coordination Center at Carnegie Mellon, and the eventual public disclosure was coordinated by CERT/CC after vendor non-response. Calix has not responded to press questions about the flaw, the affected devices, or a patch timeline.

There is still no patch.

Coordinated disclosure only works if the coordinating happens on both ends. When a vendor does not engage, the researcher is left choosing between silence — which protects nobody, since the flaw exists whether or not it is published — and disclosure without a fix, which at least lets people apply a workaround. CERT/CC exists precisely to make that second option orderly rather than reckless.

What to do

  • Turn UPnP off. In the gateway's administrative interface: Advanced → Security → UPnP. This is the researcher's recommended mitigation and it is the only one available.
  • Expect something to break. UPnP is what lets consoles, some VoIP handsets and peer-to-peer applications open their own ports. If a game's multiplayer stops working after you disable it, that is the trade, and manual port forwarding is the fix.
  • Check what is currently mapped before you disable it. If rules exist that you did not create, that is a finding, not a curiosity.
  • If your ISP supplied the box, ask them. They are the only party who can push firmware, and volume of customer contacts is the mechanism that produces one.
  • Consider putting your own router behind it if the gateway can run in bridge mode. That moves the NAT boundary to a device you control.

The wider point

We have written this month about attackers who need an old CVE and a list of 170,000 targets, or a private APN to reach a plant's controllers.

Here the requirement is a SOAP request to a port that should never have been listening. No exploit, no memory corruption, no authentication to defeat — a management interface pointed the wrong way. It is the same class of failure as the Minnesota water systems, which were disrupted without exploiting anything at all.

What is not established

  • A CVSS score. None published at the time of writing.
  • How many devices are affected. No figure from Calix or the ISPs.
  • Whether it is being exploited. No in-the-wild activity reported. That is not reassurance — a scan for TCP 5000 across an ISP's address range is trivial.
  • When a patch will arrive. No timeline given.
  • Whether other Calix models or firmware are affected. Only GS5239XG on EXOS/6.6.47 is named.