Calix GS7 Routers Expose UPnP on WAN

Published21 August 2026 Vorant ratingroutine vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Calix GS7 XGS GS5239XG routers expose an unauthenticated UPnP WANIPConnection service on the WAN interface, letting remote attackers manipulate NAT rules.

Sourcekb.cert.org — open the original

What to check

Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT/CC has disclosed CVE-2026-75501, a missing authentication vulnerability in Calix GS7 XGS GS5239XG residential gateways running firmware EXOS/6.6.47. The device's UPnP service, implemented via MiniUPnPd 2.3.7, binds its WANIPConnection SOAP interface to the public WAN interface on TCP port 5000 without requiring authentication. This is a significant deviation from expected UPnP behavior, which is normally restricted to the LAN side of a router.

An unauthenticated remote attacker can query and manipulate the router's UPnP functions, including adding, deleting, and enumerating NAT port mappings. By creating arbitrary port-forwarding rules, an attacker can bypass the device's NAT and firewall protections, exposing internal LAN devices—such as IP cameras, NAS units, and other IoT equipment—directly to the internet without the owner's knowledge.

CERT/CC was unable to reach Calix to coordinate disclosure, so no vendor patch is currently available. Recommended mitigations include disabling UPnP via the router's admin interface, requesting ISP-level deactivation if the setting is locked, or filtering inbound traffic to TCP port 5000 at the router, a secondary firewall, or the ISP level. This affects primarily residential/consumer deployments rather than enterprise networks.

Mentioned in this report

Vulnerabilities CVE-2026-75501

Detection guidance

External Source Connecting to Exposed WAN-Side UPnP Port

ATT&CK T1133 · status experimental · needs firewall logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects inbound network connections to TCP/5000 (UPnP SOAP/WANIPConnection interface) originating from a non-private source address, indicating the router's UPnP service is reachable from the WAN rather than restricted to LAN as expected. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: External Source Connecting to Exposed WAN-Side UPnP Port
description: Detects connections to TCP port 5000, the UPnP WANIPConnection SOAP control
  port on affected Calix GS7 gateways, arriving from a public (non-RFC1918) source
  address. UPnP should only ever be reachable from the LAN; WAN-side reachability
  indicates the missing-authentication exposure described in CVE-2026-75501.
tags:
- attack.initial-access
- attack.t1133
logsource:
  category: firewall
detection:
  selection:
    dst_port: 5000
  filter_private_src:
    src_ip|startswith:
    - '10.'
    - 192.168.
    - 172.16.
    - 172.17.
    - 172.18.
    - 172.19.
    - 172.20.
    - 172.21.
    - 172.22.
    - 172.23.
    - 172.24.
    - 172.25.
    - 172.26.
    - 172.27.
    - 172.28.
    - 172.29.
    - 172.30.
    - 172.31.
    - '127.'
  condition: selection and not filter_private_src
falsepositives:
- Internet-wide scanners and research crawlers probing arbitrary high ports
- Legitimate CPE management platforms or ISP monitoring systems that reach the device
  from outside the LAN by design
level: high
id: eb263d8b-8ea0-5fd8-a716-021fde980e3b
status: experimental
author: Vorant

Unauthenticated UPnP Port Mapping Manipulation via SOAP Action

ATT&CK T1599 · status experimental · needs webserver logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects UPnP WANIPConnection SOAP requests (AddPortMapping/DeletePortMapping/GetGenericPortMappingEntry) arriving from a non-LAN source, consistent with an attacker abusing the unauthenticated UPnP interface to create or enumerate NAT port-forwarding rules and bridge the network boundary. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthenticated UPnP Port Mapping Manipulation via SOAP Action
description: Detects HTTP/SOAP requests invoking UPnP WANIPConnection actions that
  add, delete, or enumerate NAT port mappings, when the requesting source is not on
  the local/private network. Generalises on the SOAP action verbs used to manipulate
  port forwarding rather than any vendor-specific URI path, matching the missing-authentication
  UPnP exposure in CVE-2026-75501.
tags:
- attack.lateral-movement
- attack.t1599
logsource:
  category: webserver
detection:
  selection_action:
    cs-uri-query|contains:
    - AddPortMapping
    - DeletePortMapping
    - GetGenericPortMappingEntry
    - GetSpecificPortMappingEntry
  filter_private_src:
    c-ip|startswith:
    - '10.'
    - 192.168.
    - 172.16.
    - 172.17.
    - 172.18.
    - 172.19.
    - 172.20.
    - 172.21.
    - 172.22.
    - 172.23.
    - 172.24.
    - 172.25.
    - 172.26.
    - 172.27.
    - 172.28.
    - 172.29.
    - 172.30.
    - 172.31.
    - '127.'
  condition: selection_action and not filter_private_src
falsepositives:
- Legitimate LAN-side applications (game consoles, VoIP, torrent clients) requesting
  port mappings if the logging point cannot distinguish LAN from WAN sources
- Vulnerability scanners or researchers actively testing for the disclosed CVE
level: high
id: d3af6228-a7be-51cd-b467-3c34d7b4a4bb
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/756733

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs