CVE-2026-75501

Report

Executive Summary

CVE-2026-75501 is an unauthenticated remote vulnerability in the Calix EXOS firmware running on the GS7 XGS (GS5239XG) residential router. The device exposes the MiniUPnPd UPnP control endpoint on the WAN interface at TCP port 5000 without any access controls, allowing remote attackers to modify NAT port-forwarding rules via crafted SOAP requests. Successful exploitation enables firewall/NAT bypass, potentially exposing internal LAN services to the public internet. The vulnerability is currently UNPATCHED (patch confidence 0/4), with no vendor fix, workaround, or proof-of-concept code publicly available.

Technical Analysis

The vulnerability resides in the UPnP (Universal Plug and Play) implementation of the Calix EXOS firmware, specifically the MiniUPnPd daemon controlling the WANIPConnection service. UPnP is a network protocol designed for automatic device discovery and configuration within local networks. The WANIPConnection service is the UPnP service responsible for managing NAT port-forwarding entries on the gateway.

The core flaw is threefold:

1. WAN Interface Exposure: The MiniUPnPd control endpoint is bound to the WAN interface rather than being restricted to the LAN side. Standard UPnP implementations should only listen on internal interfaces; exposing the control point on the WAN interface at TCP port 5000 makes the service reachable from the public internet.

2. Missing Authentication: The control endpoint is exposed without any authentication or access control mechanism. UPnP was designed as a zero-configuration protocol and historically lacks inherent authentication. However, production-grade implementations typically restrict the source of UPnP requests to trusted LAN segments. In this case, no such access control is applied to the WAN-facing endpoint.

3. Insecure Default Configuration: The firmware ships with the UPnP service enabled on the WAN interface by default, an insecure configuration that contradicts the security principle of least privilege.

Attack Mechanism: An attacker sends HTTP requests to http://<target-ip>:5000/ with a SOAP (Simple Object Access Protocol) envelope. SOAP actions within the urn:schemas-upnp-org:service:WANIPConnection:1 service namespace can perform the following operations:

• AddPortMapping: Creates a new NAT port-forwarding rule, mapping an external port to an internal IP/port.
• DeletePortMapping: Removes existing port-forwarding rules.
• GetGenericPortMappingEntry / GetSpecificPortMappingEntry: Enumerate existing port mappings.
• GetExternalIPAddress: Query the public IP address of the WAN interface.

No specific SOAP action names, XML namespaces, or endpoint paths beyond the WANIPConnection service are confirmed in the NVD description beyond these functional capabilities. The lack of authentication means a remote attacker can freely invoke these operations without any valid session or credentials.

Attack Surface: Any GS5239XG router with TCP port 5000 reachable from the internet is directly exploitable. The attack requires no user interaction, no prior authentication, and no prerequisite conditions other than network reachability.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

Step 1 — Reconnaissance / Target Identification The attacker scans the internet for devices with TCP port 5000 open. Shodan and other mass-scanning tools can identify MiniUPnPd instances by banner (e.g., MiniUPnPd/1.x) or by the absence of standard router login prompts on that port. The target is any Calix GS5239XG router exposing this port on the WAN side.

Step 2 — Flaw Trigger The attacker sends a simple HTTP GET or OPTIONS request to http://<target>:5000/ to confirm the UPnP endpoint is responsive. A successful response (HTTP 200 with UPnP XML content) confirms the service is reachable without authentication.

Step 3 — Payload / Execution The attacker crafts an HTTP POST request containing a SOAP envelope. The SOAP action header specifies the desired WANIPConnection operation. A typical malicious request would:

POST /ctl/NetWanIPCtl HTTP/1.1
Host: <target-ip>:5000
Content-Type: text/xml; charset="utf-8"
SOAPACTION: "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping"

<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
  <s:Body>
    <u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
      <!-- mapping parameters: external port, internal client IP, internal port, protocol, enabled -->
    </u:AddPortMapping>
  </s:Body>
</s:Envelope>

Note: The exact URI path (/ctl/NetWanIPCtl is not confirmed in the NVD description) is illustrative only. The description confirms the SOAP actions and the endpoint on port 5000 but not the exact URI paths.

Alternatively, the attacker could invoke DeletePortMapping to disrupt existing NAT rules (a denial-of-service vector) or GetExternalIPAddress to gather intelligence on the target network topology.

Step 4 — Post-Exploitation Impact If the attacker adds a port mapping that forwards an external port to an internal host (e.g., port 3389 to a Windows workstation, or port 22 to a Linux server), that internal service becomes publicly reachable. The attacker can then directly attack the exposed internal host. The NAT/firewall boundary — which exists precisely to prevent such access — is effectively bypassed. This can lead to:

• Lateral movement into the internal LAN.
• Credential harvesting from exposed services.
• Persistence if the attacker maps backdoor ports.
• Data exfiltration from internal hosts.
• Ransomware infection of exposed hosts.

Impact Assessment

Business Impact: High for residential customers and any small-office/home-office (SOHO) deployments using the Calix GS5239XG. The vulnerability subverts the entire purpose of the router's firewall/NAT function, exposing internal networked devices directly to the internet.

Affected Systems: All Calix GS7 XGS (GS5239XG) residential routers running EXOS firmware with UPnP enabled on the WAN interface (appears to be the default configuration based on the NVD description).

Blast Radius: While the affected device is a residential router, the impact extends to every device on the subscriber's LAN — PCs, IoT devices, network storage, security cameras, and smart-home hubs. A compromised router can also be leveraged for:

• Botnet recruitment: The router itself could be coerced into participating in DDoS attacks.
• DNS hijacking: A modified NAT rule or UPnP misconfiguration could redirect DNS traffic.
• Man-in-the-middle: If the attacker maps a port to an internal proxy they control.

CVSS: No CVSS score has been assigned (N/A). Based on the qualitative characteristics — unauthenticated, remote, network-located, low complexity, high confidentiality/integrity impact — a reasonable estimate would fall in the CVSS 9.0–9.8 (Critical) range, but this is not an official assigned score.

Detection Guidance

Sigma Rule

title: Calix EXOS UPnP WANInterface AddPortMapping Attempt
id: 8f7e1c4a-9b2d-4e6f-8a1b-3c5d7e9f1a2b
status: experimental
description: Detects unauthenticated SOAP AddPortMapping requests to MiniUPnPd on WAN interface (TCP 5000) on Calix GS5239XG.
logsource:
    category: firewall
    product: calix
detection:
    selection:
        dest_port: 5000
        src_ip:
            - '!10.0.0.0/8'
            - '!172.16.0.0/12'
            - '!192.168.0.0/16'
            - '!169.254.0.0/16'
        http_method: 'POST'
        http_content_type: 'text/xml'
    filter_upnp_soap:
        http_user_agent|contains: 'UPnP/'
    condition: selection and not filter_upnp_soap
falsepositives:
    - Legitimate remote management where UPnP is intentionally exposed (should not occur)
level: high

YARA Rule

rule CALIX_EXOS_UPnP_WAN_Exploit {
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects SOAP payloads targeting Calix EXOS MiniUPnPd WANIPConnection AddPortMapping"
        date = "2026-01-01"
        reference = "CVE-2026-75501"
        severity = "critical"
    strings:
        $soap_action_1 = "AddPortMapping" ascii wide nocase
        $soap_action_2 = "DeletePortMapping" ascii wide nocase
        $soap_action_3 = "GetExternalIPAddress" ascii wide nocase
        $service = "WANIPConnection" ascii wide nocase
        $ns = "urn:schemas-upnp-org:service:WANIPConnection:1" ascii wide nocase
        $content_type = "text/xml" ascii wide nocase
    condition:
        2 of them and $service and $ns
}

Suricata IDS Rule

alert http any any -> any 5000 (msg:"CVE-2026-75501 - Calix EXOS MiniUPnPd WAN AddPortMapping (SOAP)"; flow:to_server; content:"POST"; http_method; content:"AddPortMapping"; http_client_body; nocase; content:"WANIPConnection"; http_client_body; nocase; content:"urn:schemas-upnp-org:service:WANIPConnection"; http_header; nocase; reference:cve,2026-75501; classtype:attempted-admin; sid:1000755; rev:1;)

Elastic Detection

sequence by destination.ip
    [network where destination.port == 5000 and source.ip != "10.0.0.0/8" and source.ip != "172.16.0.0/12" and source.ip != "192.168.0.0/16" and network.direction == "inbound"]
    [http where http.request.method == "POST" and destination.port == 5000 and http.request.body.text contains "AddPortMapping"]

Splunk SPL Query

index=firewall OR index=proxy dest_port=5000
| search src_ip NOT IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
| search http_method=POST 
| search "AddPortMapping" OR "DeletePortMapping" OR "WANIPConnection"
| stats count by src_ip, dest_ip, dest_port, http_method, _time
| sort - _time

Wazuh OSSEC Rule

<group name="calix_upnp,">
  <rule id="100755" level="12">
    <if_sid>31122</if_sid> <!-- HTTP POST web request -->
    <field name="url">\.*</field>
    <regex>POST /.*</regex>
    <match>AddPortMapping</match>
    <description>CVE-2026-75501: Possible unauthenticated UPnP AddPortMapping attempt against Calix EXOS WAN interface</description>
    <group>attack.exploitation,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, no patched firmware version, no patch evidence from any tracked source has been identified. The Calix EXOS firmware for GS5239XG remains vulnerable as of this report.

Immediate Mitigations

1. Disable UPnP entirely on the router. Navigate to the router's administration interface and disable the UPnP service. This eliminates the attack surface completely (though it may impact legitimate applications that rely on UPnP for automatic port forwarding, such as gaming consoles and VoIP devices).
2. Restrict access to port 5000: If UPnP cannot be disabled immediately, configure the router's firewall to block inbound TCP connections to port 5000 from the WAN interface. In many firmware implementations this requires an explicit deny rule.
3. Verify current port-mapping state: Log into the router's admin interface and audit existing NAT port-forwarding rules. Look for suspicious entries that you did not create, indicating prior exploitation, and remove them.
4. Change the administrative credentials if any access to the router management interface has been exposed.

Patch / Upgrade Steps

• Monitor the Calix vendor portal (https://www.calix.com) for a firmware advisory regarding CVE-2026-75501. No patched version exists yet.
• Subscribe to Calix customer notifications and security bulletins for the GS7 XGS product line.
• Contact Calix support to request an ETA on the patch.

Long-Term Hardening

1. Network segmentation: Place residential gateway devices behind a perimeter firewall or CGNAT where feasible to reduce direct WAN exposure.
2. Implement egress filtering: Block outbound connections from the router to the internet on port 5000 regardless of direction.
3. Enable logging and monitoring: Log all router configuration changes and alert on unexpected modifications to NAT/port-forwarding rules.
4. Disable UPnP by default: For enterprise and SOHO deployments, make it a policy to disable UPnP on all edge devices unless there is a verified business requirement.
5. Vendor accountability: Track CVE-2026-75501 in your vulnerability management system and set a reminder to re-evaluate every 30 days until Calix releases a patch.
6. Consider device replacement: If the router is at end-of-life or the vendor fails to patch in a reasonable timeframe, recommend replacement with a device from a vendor with a demonstrated security maintenance commitment.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75501
2. Calix Official Website: https://www.calix.com
3. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
4. OWASP UPnP Security Overview: https://owasp.org/www-community/UPnP_Security
5. US-CERT Alert on UPnP Risks: https://www.cisa.gov/news-events/alerts/2013/01/31/upnp-and-nat-port-mapping-vulnerabilities

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No public exploitation, weaponized PoC, or threat-actor campaign associated with this specific CVE has been observed at the time of writing. However, the class of vulnerability — WAN-exposed MiniUPnPd — has been actively exploited in the wild for over a decade. Notable prior campaigns include the 2014 "UPnProxy" exploits and 2018 "CVE-2018-1111" style DNS poisoning via rogue DHCP. The Mirai botnet family has also historically targeted UPnP-enabled devices to create port mappings for hosting botnet command-and-control infrastructure. Operators of Calix GS5239XG routers should assume they are at risk and prioritize mitigation.