Calix GS7 Routers Expose UPnP on WAN

21 August 2026 routine vulnerability

Calix GS7 XGS GS5239XG routers expose an unauthenticated UPnP WANIPConnection service on the WAN interface, letting remote attackers manipulate NAT rules.

CERT/CC has disclosed CVE-2026-75501, a missing authentication vulnerability in Calix GS7 XGS GS5239XG residential gateways running firmware EXOS/6.6.47. The device's UPnP service, implemented via MiniUPnPd 2.3.7, binds its WANIPConnection SOAP interface to the public WAN interface on TCP port 5000 without requiring authentication. This is a significant deviation from expected UPnP behavior, which is normally restricted to the LAN side of a router.

An unauthenticated remote attacker can query and manipulate the router's UPnP functions, including adding, deleting, and enumerating NAT port mappings. By creating arbitrary port-forwarding rules, an attacker can bypass the device's NAT and firewall protections, exposing internal LAN devices—such as IP cameras, NAS units, and other IoT equipment—directly to the internet without the owner's knowledge.

CERT/CC was unable to reach Calix to coordinate disclosure, so no vendor patch is currently available. Recommended mitigations include disabling UPnP via the router's admin interface, requesting ISP-level deactivation if the setting is locked, or filtering inbound traffic to TCP port 5000 at the router, a secondary firewall, or the ISP level. This affects primarily residential/consumer deployments rather than enterprise networks.

Mentioned in this report

Vulnerabilities CVE-2026-75501

Detection guidance

External Source Connecting to Exposed WAN-Side UPnP Port

ATT&CK T1133

Detects inbound network connections to TCP/5000 (UPnP SOAP/WANIPConnection interface) originating from a non-private source address, indicating the router's UPnP service is reachable from the WAN rather than restricted to LAN as expected. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: External Source Connecting to Exposed WAN-Side UPnP Port
description: Detects connections to TCP port 5000, the UPnP WANIPConnection SOAP control
  port on affected Calix GS7 gateways, arriving from a public (non-RFC1918) source
  address. UPnP should only ever be reachable from the LAN; WAN-side reachability
  indicates the missing-authentication exposure described in CVE-2026-75501.
tags:
- attack.initial-access
- attack.t1133
logsource:
  category: firewall
  product: generic
detection:
  selection:
    dst_port: 5000
  filter_private_src:
    src_ip|startswith:
    - '10.'
    - 192.168.
    - 172.16.
    - 172.17.
    - 172.18.
    - 172.19.
    - 172.20.
    - 172.21.
    - 172.22.
    - 172.23.
    - 172.24.
    - 172.25.
    - 172.26.
    - 172.27.
    - 172.28.
    - 172.29.
    - 172.30.
    - 172.31.
    - '127.'
  condition: selection and not filter_private_src
falsepositives:
- Internet-wide scanners and research crawlers probing arbitrary high ports
- Legitimate CPE management platforms or ISP monitoring systems that reach the device
  from outside the LAN by design
level: high
id: eb263d8b-8ea0-5fd8-a716-021fde980e3b
status: experimental
author: Vorant

Unauthenticated UPnP Port Mapping Manipulation via SOAP Action

ATT&CK T1599

Detects UPnP WANIPConnection SOAP requests (AddPortMapping/DeletePortMapping/GetGenericPortMappingEntry) arriving from a non-LAN source, consistent with an attacker abusing the unauthenticated UPnP interface to create or enumerate NAT port-forwarding rules and bridge the network boundary. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthenticated UPnP Port Mapping Manipulation via SOAP Action
description: Detects HTTP/SOAP requests invoking UPnP WANIPConnection actions that
  add, delete, or enumerate NAT port mappings, when the requesting source is not on
  the local/private network. Generalises on the SOAP action verbs used to manipulate
  port forwarding rather than any vendor-specific URI path, matching the missing-authentication
  UPnP exposure in CVE-2026-75501.
tags:
- attack.lateral-movement
- attack.t1599
logsource:
  category: webserver
detection:
  selection_action:
    cs-uri-query|contains:
    - AddPortMapping
    - DeletePortMapping
    - GetGenericPortMappingEntry
    - GetSpecificPortMappingEntry
  filter_private_src:
    c-ip|startswith:
    - '10.'
    - 192.168.
    - 172.16.
    - 172.17.
    - 172.18.
    - 172.19.
    - 172.20.
    - 172.21.
    - 172.22.
    - 172.23.
    - 172.24.
    - 172.25.
    - 172.26.
    - 172.27.
    - 172.28.
    - 172.29.
    - 172.30.
    - 172.31.
    - '127.'
  condition: selection_action and not filter_private_src
falsepositives:
- Legitimate LAN-side applications (game consoles, VoIP, torrent clients) requesting
  port mappings if the logging point cannot distinguish LAN from WAN sources
- Vulnerability scanners or researchers actively testing for the disclosed CVE
level: high
id: d3af6228-a7be-51cd-b467-3c34d7b4a4bb
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/756733

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free