Calix GigaSpire EUVD-2026-58225

Q: What is the CVSS score of EUVD-2026-58225?

EUVD-2026-58225 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-19746 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-08-13 VulDB

GHSA-6w9r-x9gv-7c46

Denial Of Service Gigaspire Calix

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable via management plane but requires low-privilege authentication; only availability is affected, and impact is partial.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 13, 2026 - 20:22 NVD

MEDIUM LOW

CVSS changed

Aug 13, 2026 - 20:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 13, 2026 - 20:17 vuln.today

DescriptionCVE.org

A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Denial of service in Calix GigaSpire 26.1.0 is reachable remotely through manipulation of the traceroute.cmd diagnostic endpoint, causing availability disruption to the affected device. The root cause is improper resource handling (CWE-404) within the traceroute function, which fails to properly release resources under adversarial input. A proof-of-concept exploit has been publicly disclosed; no vendor patch or advisory is available as the vendor did not respond to coordinated disclosure.

Technical ContextAI

The Calix GigaSpire is a residential and SMB gateway platform deployed by broadband service providers, primarily in North America. The affected component is traceroute.cmd, a diagnostic interface function exposed through the device's management plane. CWE-404 (Improper Resource Shutdown or Release) indicates the traceroute processing logic fails to cleanly terminate or release a system resource - such as a process, socket, or file descriptor - when provided with manipulated input, resulting in resource exhaustion and device unavailability. The CPE string cpe:2.3:a:calix:gigaspire:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting NVD has not yet constrained the affected version range beyond the reported 26.1.0.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure attempt. Operators should consider restricting access to the traceroute.cmd diagnostic endpoint at the network perimeter, such as blocking management-plane access from untrusted networks and ensuring that low-privilege portal accounts cannot reach diagnostic functions without explicit authorization. Rate-limiting requests to diagnostic endpoints on upstream firewalls or the ISP's CPE management infrastructure can reduce the likelihood of successful DoS. Monitoring for anomalous traceroute invocations on managed gateways may help detect exploitation attempts. Trade-off: disabling diagnostic interfaces may impair legitimate remote troubleshooting workflows. Operators should track Calix's security advisory feed for any future patch release. References: https://vuldb.com/vuln/389484, https://vuldb.com/cve/CVE-2026-19746.