Calix CVE-2026-75501: your ISP router opens your LAN

The router your broadband provider installed in your office closet has an unauthenticated control port facing the internet. CERT/CC published VU#756733 on August 21: CVE-2026-75501, a missing-authentication flaw in the Calix GS7 XGS (GS5239XG) residential router running firmware EXOS/6.6.47. There is no patch. CERT/CC could not establish contact with Calix to coordinate one.

What actually happened

The device exposes its MiniUPnPd control endpoint on the WAN interface, TCP port 5000, with no access controls. UPnP is designed to let devices inside your network ask the router to open a port. Here the service accepts SOAP requests from anywhere and does not ask who is calling. A remote attacker gets the full UPnP function set: add, delete, and enumerate NAT port mappings on your router.

That means an attacker on the public internet can forward external traffic straight to an internal IP and port of their choosing. NAT stops being a boundary. Anything sitting behind it on a default deny-inbound assumption — the NAS with the backups, the camera recorder, the POS controller, the printer nobody has updated since 2021 — becomes directly reachable. And because the router ships with UPnP enabled by default, exposure is the out-of-the-box state, not a misconfiguration somebody made.

CERT/CC's mitigations are the whole remediation list, because there is no update to install: disable UPnP in the router's admin interface, ask your ISP to disable it at the carrier level, and block inbound TCP 5000 at the router, a secondary firewall, or upstream. BleepingComputer reports the affected units are in service across multiple U.S. broadband providers.

Why an unpatchable router matters for your business

You do not own the box, but you own the blast radius. ISP-supplied gear arrives configured by someone whose incentives are provisioning speed, not your threat model. It is still the only thing between your LAN and the internet.

"It's behind NAT" was never a security control. It was an address-space accident that felt like one. This CVE is what it looks like when the accident is writable by strangers.

No vendor contact means no timeline. You cannot put "wait for the patch" in the ticket. Disable UPnP today and decide whether anything on your network actually needed it. Almost nothing in a business network does — UPnP exists for consumer game consoles and torrent clients, not for your accounting workstation.

Then go look at what would have been exposed. Enumerate what listens on your LAN and ask which of those would survive being reachable from the open internet for a week. That inventory is worth more than this specific CVE.

Sources: CERT/CC VU#756733, BleepingComputer.