Okay, time for the low-drama, high-risk PSA: a bug in certain Calix residential gateways lets anyone on the internet tell your router to forward traffic straight into your living room. No password. No pop-up. Just pure, uninvited access.

What happened?

Researcher Brian Khan Quintana found an issue tracked as CVE-2026-75501 affecting Calix GS7 XGS (GS5239XG) devices running EXOS/6.6.47 firmware. The router exposes the MiniUPnPd control endpoint on the WAN side over TCP port 5000 without access controls. In plain English: the router’s UPnP WANIPConnection service listens on the public internet and accepts unauthenticated SOAP requests that can add, remove, or list port mappings and reveal the device’s public IP.

That means an attacker can create permanent port-forwarding rules that survive reboots and bypass the router’s NAT and firewall, pointing public ports at cameras, NAS boxes, admin panels, smart fridges—whatever you’ve got tucked away on the LAN.

After trying (and failing) to get a response from the vendor, the researcher reported the issue to CERT/CC, which coordinated the public disclosure.

What an attacker can do (yes, really)

  • Create arbitrary port-forwarding rules to route incoming traffic to devices inside the home.
  • Delete existing mappings, possibly breaking services you rely on.
  • Enumerate the router’s current mappings to scout targets.
  • Retrieve the router’s public IP address so they know where to aim their shenanigans.

In short: one unauthenticated request from anywhere can carve a hole through the router and leave it there. No dialog, no confirmation. The mapping can be set with no expiration and will persist across power cycles.

What you can do right now

Until a proper firmware fix is released, the quickest defense is to turn off UPnP on the gateway. Look for the setting in the router admin interface under Advanced → Security → UPnP and disable it. This stops automatic port openings (some games and apps may need manual port configuration instead).

If you can’t change that setting because your internet provider locked the configuration, contact your ISP and ask them to disable UPnP for your device. If that’s not possible, consider moving sensitive services off the affected device or behind an additional router/firewall that you control.

Summary: affected Calix GS5239XG routers running the noted firmware expose a WAN UPnP control endpoint that allows unauthenticated port-mapping. The workaround is to disable UPnP or request your ISP do it for you. Keep an eye out for a firmware update and, in the meantime, assume any exposed ports are probably not your friend.