VU#756733: Calix GS7 XGS GS5239XG residential router contains missing authentication vulnerability
CERT/CC warns Calix GS7 XGS GS5239XG routers on firmware EXOS/6.6.47 expose an unauthenticated UPnP WANIPConnection service on the public WAN interface.
CERT/CC issued VU#756733 for a missing authentication vulnerability in the Calix GS7 XGS GS5239XG residential gateway running EXOS/6.6.47. The device's UPnP service, implemented with MiniUPnPd 2.3.7, is exposed on the WAN interface by default and does not require authentication, potentially letting remote attackers alter port mappings through the WANIPConnection service. The flaw affects routing, NAT, and firewall functionality for home networks.
- UPnP WANIPConnection service exposed on WAN without authentication
- Affects firmware EXOS/6.6.47 using MiniUPnPd 2.3.7
- Default configuration leaves the service publicly reachable
- Tracked as CERT/CC vulnerability note VU#756733
From the original article
Overview The Calix GS7 XGS GS5239XG router running firmware EXOS/6. 6. 47 contains a missing authentication vulnerability that exposes its UPnP (Universal Plug and Play) WANIPConnection service on the public WAN interface.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.