EUVD-2026-63988
GHSA-f7wj-3v6p-grpv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
WAN-exposed service with no authentication (AV:N, PR:N, AC:L); only NAT rule integrity is impacted (I:H), with no confidentiality leak or availability disruption on the device itself.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls. A remote attacker can send crafted SOAP requests to add, delete, or enumerate port mappings, or to query the external IP address, without authentication. Successful exploitation may enable bypass of the firewall/NAT boundary and exposure of internal LAN services to the public internet.
AnalysisAI
Unauthenticated remote manipulation of NAT port-forwarding rules is possible on the Calix GS7 XGS (GS5239XG) residential router running EXOS firmware through version 6.6.47, because MiniUPnPd exposes its UPnP WANIPConnection SOAP control endpoint on the WAN-facing interface at TCP port 5000 with no access controls. An attacker reachable over the public internet can add, delete, or enumerate port mappings and query the external IP address without any credentials, effectively piercing the NAT/firewall boundary and exposing arbitrary internal LAN services to the internet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The router must be running Calix EXOS firmware version 6.6.47 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N accurately reflects the trivial exploitation bar: no authentication, no user interaction, no special conditions, and reachable directly from the internet. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans the internet for hosts with TCP port 5000 open and fingerprints them as Calix GS7 XGS devices via UPnP service description responses. The attacker then sends a crafted SOAP AddPortMapping request specifying an external port of their choosing and an internal destination of a LAN host (e.g., 192.168.1.x port 22 or 3389), causing the router to forward inbound internet traffic on that port directly to the internal host - effectively punching a hole through the NAT/firewall boundary with no authentication and no interaction required from any user. … |
| Remediation | No specific patched firmware version is identified in the available intelligence; patch availability should be verified directly with Calix via the CERT/CC advisory at https://kb.cert.org/vuls/id/756733 and the researcher disclosure at https://drkq.github.io/security-research/calix-vu756733/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all Calix GS7 XGS (GS5239XG) devices running EXOS firmware version 6.6.47 or earlier, prioritize internet-facing and untrusted-network deployments, and contact Calix support for interim guidance while preparing device isolation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today