VU#756733: Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability

The reported vulnerability CVE-2026-75501 concerned a missing authentication issue in the UPnP WANIPConnection SOAP service on Calix GS7 XGS GS5239XG routers running EXOS firmware, which binds to TCP port 5000 on the WAN interface. This would have allowed unauthenticated remote attackers to add, delete, or enumerate NAT port mappings, potentially bypassing firewall and NAT protections. However, Calix's investigation found that the default WAN firewall blocks inbound traffic to TCP port 5000, preventing access to the UPnP service from outside the network. Multiple tests across devices, firmware versions, and environments confirmed that the vulnerability could not be reproduced and that security controls function as designed. Calix has not identified any customer-impacting exposure or affected deployments and states no action is required.

If exploitable, the vulnerability would have allowed unauthenticated remote attackers to manipulate NAT port-forwarding rules, bypassing firewall and NAT protections to expose internal LAN devices to the public internet. This could have posed significant risks to residential users with network-connected devices. However, due to default firewall rules blocking access to the vulnerable service, no actual exposure has been confirmed in deployed systems. No customer-impacting incidents or exposures have been identified.

No mitigation or patch is currently required as Calix has confirmed that the default firmware configuration blocks inbound WAN traffic to TCP port 5000, preventing exploitation. Users do not need to take any action at this time. If users have concerns, they may consider disabling UPnP or filtering inbound traffic to TCP port 5000, but these are not mandated by Calix. The vendor continues to monitor the situation.