bleepingcomputer[.]com/news/security/unpatched-calix-flaw-lets-hackers-bypass-nat-to-expose-internal-devices/

Calix is a significant vendor in the US broadband-provider market, working with large entities such as Cox Communications, Brightspeed, ALLO, CityFibre, and Conexon.

The affected model, GS5239XG, is also marketed as the GigaSpire 7u10txg and is a new, premium gateway device that combines Wi-Fi 7 capabilities with an integrated XGS-PON fiber terminal.

The CVE-2026-75501 vulnerability is caused by the device exposing "the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls."

“In affected firmware versions, the router binds its UPnP WANIPConnection SOAP service to the public WAN interface on TCP port 5000,” CERT/CC warns.

This allows an attacker on the public web to send the device unauthenticated "SOAP requests to add, delete, or enumerate port mappings, or to query the external IP address."

This way, hackers can bypass the router's Network Address Translation (NAT) and firewall protections and expose internal cameras, network-attached storage (NAS) devices, administrative interfaces, and IoT appliances.

"One unauthenticated request from anywhere in the world is enough to open a permanent hole through the router's firewall to any device inside the house. No password. No prompt. Nothing on screen. The rule survives a reboot," Quintatna says.

The researcher says that an attacker leveraging the security issue could take the following actions:

Create arbitrary port-forwarding rules
Delete existing mappings
Enumerate the router’s current mappings
Retrieve its public IP address

This practically means anyone on the internet can instruct vulnerable Calix routers to forward traffic from a public-facing port to a chosen device on the home network.

Given that there’s no fix for CVE-2026-75501, Quintana recommends that users of the vulnerable device disable UPnP through the administrative interface (Advanced → Security → UPnP).

The researcher notes that this workaround disables automatic port opening, which some games rely on, but it’s always possible to open specific ports manually.

CERT/CC also notes that the setting might be locked in some cases, and users who can't change it should contact their ISP to request the deactivation.