Update August 27, 2026:
Calix has issued the following statement regarding CVE-2026-75501: "We conducted our own investigation immediately upon becoming aware of the public report and have determined through testing and analysis that existing network security controls in deployed systems prevent exploitation of the reported attack scenario."Previous report:As reported by Bleeping Computer, a vulnerability in Calix GS7 XGS residential routers, utilized by numerous U.S. broadband providers, enables unauthenticated remote attackers to establish port-forwarding rules, thereby exposing local network devices to the public internet.The flaw, identified as CVE-2026-75501, affects devices running EXOS/6.6.47 firmware. Security researcher Brian Khan Quintana discovered that the router exposes its UPnP control endpoint on the WAN interface without proper access controls. This allows attackers to send unauthenticated SOAP requests to add, delete, or enumerate port mappings, effectively bypassing the router's NAT and firewall protections. This could expose internal devices like cameras, NAS drives, and IoT appliances to the internet.Quintana demonstrated that a single request could create a permanent firewall hole that survives reboots. Calix, a major vendor for U.S. broadband providers like Cox Communications and Brightspeed, has not yet released a patch. Quintana recommends disabling UPnP as a workaround, though this may affect some gaming functionality. Users unable to disable UPnP should contact their ISP.Source: Bleeping Computer
Calix has issued the following statement regarding CVE-2026-75501: "We conducted our own investigation immediately upon becoming aware of the public report and have determined through testing and analysis that existing network security controls in deployed systems prevent exploitation of the reported attack scenario."Previous report:As reported by Bleeping Computer, a vulnerability in Calix GS7 XGS residential routers, utilized by numerous U.S. broadband providers, enables unauthenticated remote attackers to establish port-forwarding rules, thereby exposing local network devices to the public internet.The flaw, identified as CVE-2026-75501, affects devices running EXOS/6.6.47 firmware. Security researcher Brian Khan Quintana discovered that the router exposes its UPnP control endpoint on the WAN interface without proper access controls. This allows attackers to send unauthenticated SOAP requests to add, delete, or enumerate port mappings, effectively bypassing the router's NAT and firewall protections. This could expose internal devices like cameras, NAS drives, and IoT appliances to the internet.Quintana demonstrated that a single request could create a permanent firewall hole that survives reboots. Calix, a major vendor for U.S. broadband providers like Cox Communications and Brightspeed, has not yet released a patch. Quintana recommends disabling UPnP as a workaround, though this may affect some gaming functionality. Users unable to disable UPnP should contact their ISP.Source: Bleeping Computer
