Vulnerabilities & PatchesEmerging1 src
VU#756733: Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability
Overview
The Calix GS7 XGS GS5239XG router running firmware EXOS/6. 6. 47 contains a missing authentication vulnerability that exposes its UPnP (Universal Plug and Play) WANIPConnection service on the public WAN interface.
Description
Calix GS7 XGS GS5239XG is a residential gateway that provides routing, NAT, and firewall functionality for home networks. The device includes the Universal Plug and Play (UPnP) service implemented via MiniUPnPd 2. 3. 7, a lightweight software program that provides features such as automatic port forwarding for applications and devices on the LAN.
By default, the UPnP service is exposed on the device’s WAN interface and does not require authentication.
CVE-2026-75501 In affected firmware versions, the router binds its UPnP WANIPConnection SOAP service to the public WAN interface on TCP port 5000.