Calix GigaSpire CVE-2026-19745

Q: What is the CVSS score of CVE-2026-19745?

CVE-2026-19745 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-58241 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-08-13 VulDB

GHSA-693x-w4h4-3ppc

Denial Of Service Gigaspire Calix

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable CGI endpoint with low-privilege auth requirement; impact is solely low availability loss with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 13, 2026 - 20:22 NVD

MEDIUM LOW

CVSS changed

Aug 13, 2026 - 20:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 13, 2026 - 20:01 vuln.today

DescriptionCVE.org

A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Denial of service in Calix GigaSpire 26.1.0 is achievable remotely by low-privileged attackers who manipulate the sessionKey argument within the utilities_configurationsave.cgi endpoint of the Web Management Interface, causing improper resource release (CWE-404) and disrupting device availability. The affected product is a residential and SMB broadband gateway deployed by ISPs. Published exploit code exists (E:P in the CVSS 4.0 vector), and no vendor patch has been confirmed - the vendor did not respond to the coordinated disclosure.

Technical ContextAI

The vulnerability resides in a CGI script (utilities_configurationsave.cgi) exposed through the embedded Web Management Interface of the Calix GigaSpire broadband gateway running firmware version 26.1.0, identified via CPE cpe:2.3:a:calix:gigaspire:*:*:*:*:*:*:*:*. CWE-404 (Improper Resource Shutdown or Release) is the root cause class, indicating that supplying a malformed or unexpected sessionKey value causes the CGI handler to fail to properly release or terminate an internal resource - such as a file descriptor, socket, process handle, or memory allocation - eventually triggering a device hang or crash. CGI-based web management interfaces on embedded devices commonly lack robust input validation and error-path resource cleanup, making them structurally susceptible to this class of defect.

RemediationAI

No vendor-released patch has been identified at time of analysis, and the vendor did not respond to the coordinated disclosure. As a compensating control, administrators and ISPs should restrict access to the GigaSpire Web Management Interface by disabling remote web management access where not operationally required, or by limiting it to trusted management VLANs or IP ranges via ACLs - this reduces the network attack surface significantly. If the management interface must be exposed, enforce strong, unique credentials to raise the bar above the PR:L requirement. ISPs managing fleets of GigaSpire devices should monitor VulDB (https://vuldb.com/vuln/389483) and Calix's official support channels for firmware updates addressing this issue. Note that restricting the web interface may impact remote troubleshooting workflows for ISP NOC teams.