The router's UPnP service is listening on the internet side — and anyone can use it to open a door into the house
2026-08-25Security
A Calix fibre gateway exposes its UPnP control endpoint on the WAN interface on TCP 5000 with no access control. Unauthenticated requests can create port-forwarding rules that survive a reboot. The researcher reported it on 7 June, got no answer, and went to CERT/CC. There is still no patch, and the device is supplied by ISPs.