Vendor could not replicate the vul, and reporter is unavailable to comment.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Calix Subscribe
Gs7 Xgs (gs5239xg) Subscribe

Project Subscriptions

Vendors Products
Calix Subscribe
Gs7 Xgs (gs5239xg) Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

No reference.

History

Tue, 15 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Title CVE-2026-75501 Unauthenticated Remote Modification of NAT Port‑Forwarding via UPnP on Calix GS7 XGS Router
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls. A remote attacker can send crafted SOAP requests to add, delete, or enumerate port mappings, or to query the external IP address, without authentication. Successful exploitation may enable bypass of the firewall/NAT boundary and exposure of internal LAN services to the public internet. Vendor could not replicate the vul, and reporter is unavailable to comment.

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Calix
Calix gs7 Xgs (gs5239xg)
Vendors & Products Calix
Calix gs7 Xgs (gs5239xg)

Fri, 21 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-276
CWE-284

Fri, 21 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
References

Fri, 21 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Description A vulnerability in the Calix EXOS firmware for the GS7 XGS (GS5239XG) residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls. A remote attacker can send crafted SOAP requests to add, delete, or enumerate port mappings, or to query the external IP address, without authentication. Successful exploitation may enable bypass of the firewall/NAT boundary and exposure of internal LAN services to the public internet.
Title CVE-2026-75501
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: REJECTED

Assigner: certcc

Published:

Updated: 2026-09-15T19:44:44.285Z

Reserved: 2026-08-17T20:36:51.717Z

Link: CVE-2026-75501

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-08-21T15:16:47.070

Modified: 2026-09-15T20:17:47.897

Link: CVE-2026-75501

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T03:45:03Z

Weaknesses