Back Scworld

Unpatched Calix router vulnerability allows remote attackers to expose home networks

Scworld • August 25, 2026

As reported by Bleeping Computer, a critical vulnerability in Calix GS7 XGS residential routers, utilized by numerous U.S. broadband providers, enables unauthenticated remote attackers to establish port-forwarding rules, thereby exposing local network devices to the public internet.

The flaw, identified as CVE-2026-75501, affects devices running EXOS/6.6.47 firmware. Security researcher Brian Khan Quintana discovered that the router exposes its UPnP control endpoint on the WAN interface without proper access controls. This allows attackers to send unauthenticated SOAP requests to add, delete, or enumerate port mappings, effectively bypassing the router's NAT and firewall protections. This could expose internal devices like cameras, NAS drives, and IoT appliances to the internet.

Quintana demonstrated that a single request could create a permanent firewall hole that survives reboots. Calix, a major vendor for U.S. broadband providers like Cox Communications and Brightspeed, has not yet released a patch. Quintana recommends disabling UPnP as a workaround, though this may affect some gaming functionality. Users unable to disable UPnP should their ISP.

Source: Bleeping Computer

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Calix Router Flaw Exposes Home Networks to Attack A critical vulnerability in Calix GS5239XG routers, tracked as CVE-2026-75501, allows unauthenticated remote attackers to create port-forwarding rules, exposing internal devices to the internet. Discovered by researcher Brian Khan Quintana, the flaw stems from the router's UPnP control endpoint being accessible on the WAN interface without authentication. This issue affects devices running EXOS/6.6.47 firmware and has been confirmed by the Carnegie Mellon CERT Coordination Center. No patch or firmware update has been released by Calix, and users are advised to disable UPnP as a temporary workaround. The vulnerability places millions of devices at risk, as many routers are provisioned with UPnP enabled by default. The potential impact includes exposure of sensitive internal devices like cameras and NAS drives. The situation is urgent, with active exploitation observed in the wild, as attackers can easily manipulate the router settings without user intervention. 4 sources 70

Extracted Entities

Unpatched Calix router vulnerability allows remote attackers to expose home networks

The full story

Extracted Entities

Companies (3)

CVEs (1)

CWE Weaknesses (1)

Platforms (2)