Gs7 Xgs Gs5239Xg
Monthly
Unauthenticated remote manipulation of NAT port-forwarding rules is possible on the Calix GS7 XGS (GS5239XG) residential router running EXOS firmware through version 6.6.47, because MiniUPnPd exposes its UPnP WANIPConnection SOAP control endpoint on the WAN-facing interface at TCP port 5000 with no access controls. An attacker reachable over the public internet can add, delete, or enumerate port mappings and query the external IP address without any credentials, effectively piercing the NAT/firewall boundary and exposing arbitrary internal LAN services to the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS places current exploitation probability at 0.37% (30th percentile), though the trivial attack complexity and zero authentication requirement make the vulnerability highly accessible if the device is discovered.
Unauthenticated remote manipulation of NAT port-forwarding rules is possible on the Calix GS7 XGS (GS5239XG) residential router running EXOS firmware through version 6.6.47, because MiniUPnPd exposes its UPnP WANIPConnection SOAP control endpoint on the WAN-facing interface at TCP port 5000 with no access controls. An attacker reachable over the public internet can add, delete, or enumerate port mappings and query the external IP address without any credentials, effectively piercing the NAT/firewall boundary and exposing arbitrary internal LAN services to the internet. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS places current exploitation probability at 0.37% (30th percentile), though the trivial attack complexity and zero authentication requirement make the vulnerability highly accessible if the device is discovered.