Calix
Monthly
Unauthenticated remote manipulation of NAT port-forwarding rules is possible on the Calix GS7 XGS (GS5239XG) residential router running EXOS firmware through version 6.6.47, because MiniUPnPd exposes its UPnP WANIPConnection SOAP control endpoint on the WAN-facing interface at TCP port 5000 with no access controls. An attacker reachable over the public internet can add, delete, or enumerate port mappings and query the external IP address without any credentials, effectively piercing the NAT/firewall boundary and exposing arbitrary internal LAN services to the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS places current exploitation probability at 0.37% (30th percentile), though the trivial attack complexity and zero authentication requirement make the vulnerability highly accessible if the device is discovered.
Denial of service in Calix GigaSpire 26.1.0 is reachable remotely through manipulation of the traceroute.cmd diagnostic endpoint, causing availability disruption to the affected device. The root cause is improper resource handling (CWE-404) within the traceroute function, which fails to properly release resources under adversarial input. A proof-of-concept exploit has been publicly disclosed; no vendor patch or advisory is available as the vendor did not respond to coordinated disclosure.
Denial of service in Calix GigaSpire 26.1.0 is achievable remotely by low-privileged attackers who manipulate the sessionKey argument within the utilities_configurationsave.cgi endpoint of the Web Management Interface, causing improper resource release (CWE-404) and disrupting device availability. The affected product is a residential and SMB broadband gateway deployed by ISPs. Published exploit code exists (E:P in the CVSS 4.0 vector), and no vendor patch has been confirmed - the vendor did not respond to the coordinated disclosure.
Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access. Rated high severity (CVSS 8.7), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote manipulation of NAT port-forwarding rules is possible on the Calix GS7 XGS (GS5239XG) residential router running EXOS firmware through version 6.6.47, because MiniUPnPd exposes its UPnP WANIPConnection SOAP control endpoint on the WAN-facing interface at TCP port 5000 with no access controls. An attacker reachable over the public internet can add, delete, or enumerate port mappings and query the external IP address without any credentials, effectively piercing the NAT/firewall boundary and exposing arbitrary internal LAN services to the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS places current exploitation probability at 0.37% (30th percentile), though the trivial attack complexity and zero authentication requirement make the vulnerability highly accessible if the device is discovered.
Denial of service in Calix GigaSpire 26.1.0 is reachable remotely through manipulation of the traceroute.cmd diagnostic endpoint, causing availability disruption to the affected device. The root cause is improper resource handling (CWE-404) within the traceroute function, which fails to properly release resources under adversarial input. A proof-of-concept exploit has been publicly disclosed; no vendor patch or advisory is available as the vendor did not respond to coordinated disclosure.
Denial of service in Calix GigaSpire 26.1.0 is achievable remotely by low-privileged attackers who manipulate the sessionKey argument within the utilities_configurationsave.cgi endpoint of the Web Management Interface, causing improper resource release (CWE-404) and disrupting device availability. The affected product is a residential and SMB broadband gateway deployed by ISPs. Published exploit code exists (E:P in the CVSS 4.0 vector), and no vendor patch has been confirmed - the vendor did not respond to the coordinated disclosure.
Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access. Rated high severity (CVSS 8.7), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.