DEV Community

Anoymask
Anoymask

Posted on

CVE-2026-75501: Calix Router WAN-side UPnP Exposes Internal Devices

#security #threatintel

1. Basic Information

2. Executive Summary

An unpatched vulnerability allows attackers on the internet to bypass NAT and firewalls. The router exposes UPnP control (normally used only within the LAN) without authentication on WAN-side TCP port 5000. Attackers can add port forwarding rules and expose internal cameras, NAS devices, and management interfaces to the external network.

3. Attack Flow

1. Unauthenticated UPnP Control

  1. The attacker connects to TCP port 5000 on the public IP of the target router.
  2. They get the UPnP service description from rootDesc.xml and find the WANIPConnection:1 control endpoint at /ctl/IPConn.
  3. They call GetExternalIPAddress and GetGenericPortMappingEntry using unauthenticated SOAP requests to get the public IP and existing port mappings.
  4. They use AddPortMapping to create a forwarding rule from any external port to a chosen LAN IP and port.

2. Persistent External Exposure and Subsequent Compromise

  1. A forwarding rule with a lease duration of 0 never expires. In researcher tests, it remained even after the router rebooted.
  2. Through the new public port, the attacker reaches cameras, NAS devices, IoT devices, and management interfaces that are normally inside the NAT and firewall.
  3. If the exposed internal service has another vulnerability, default credentials, or weak authentication, the attacker can compromise the internal device.
  4. They can also use DeletePortMapping to delete legitimate forwarding rules and disrupt services for users.

4. Attacker Position and Execution Location

  • The attacker is on the internet and can reach TCP port 5000 on the WAN side of the target router.
  • MiniUPnPd 2.3.7 on the Calix router processes the SOAP requests and changes the NAT and firewall forwarding rules.
  • The initial success point is the router settings interface. This does not mean code ran on a device inside the LAN.
  • Subsequent attacks target devices inside the LAN directly through the created external ports. Research articles do not report active attacks against third-party devices yet.

5. Visibility for Victims and Administrators

Victims

  • There are no password prompts, clicks, or visual screens. Router users receive no notification.
  • Even if internal devices suddenly become accessible from the internet, normal user experience may not change.
  • If legitimate port mappings are deleted, gaming, cameras, and remote connections may stop working.

Administrators / SOCs

  • WAN-side TCP port 5000 is open. External users can access rootDesc.xml and /ctl/IPConn.
  • The router management port forwarding table shows rules with unknown owners, a lease duration of 0, or unexpected LAN IPs.
  • Researchers state there are no recorded incidents. Router audit logs alone may not show the request source or change time.
  • Rebooting the router does not remove the rules. The external exposure continues even after a reboot.

6. Success and Failure Conditions

Success Conditions

  • A Calix GS7 XGS GS5239XG runs vulnerable EXOS version 6.6.47, and UPnP is enabled.
  • MiniUPnPd on TCP port 5000 is exposed to the WAN side and is not blocked by the ISP or upstream firewall.
  • The attacker knows the public IP of the target and sends correct SOAP requests.
  • The specified LAN IP and port exist and respond to subsequent access.

Failure Conditions

  • Disable UPnP in the management settings. If settings are locked, ask the ISP to disable it.
  • Block inbound traffic to TCP port 5000 from the WAN side at the router, secondary firewall, or ISP level.
  • Apply a vendor patch that binds UPnP control to the LAN side only. At the time of publication, there is no patched version and no vendor statement.
  • Delete unauthorized forwarding rules and apply source restrictions and strong authentication on the exposed internal devices.

7. What Happens on Success

  • Any internal LAN service protected by NAT or firewalls becomes publicly exposed.
  • Cameras, NAS devices, IoT devices, router management screens, and work terminals become directly attackable from the internet.
  • The existing port forwarding table and router public IP are retrieved.
  • Legitimate forwarding rules are deleted, causing service outages.
  • Actual compromise of internal devices requires additional conditions, such as vulnerabilities in the exposed service or broken authentication.

8. Observable Logs

Email

  • No logs related to email because email is not used.

Proxy / SWG / DNS

  • There are likely no DNS logs because requests are sent directly to the IP address.
  • Unless the target router is behind a proxy, requests will not appear in general corporate Secure Web Gateways (SWG).
  • Inbound traffic to WAN-side TCP port 5000, captured by ISPs or upstream firewalls, is the primary observation point.

Endpoint / EDR

  • Routers usually do not have EDR. EDR on internal LAN endpoints will not see the initial vulnerability exploit requests.
  • On the endpoint that received the forwarding rule, you can see connections from internet sources to services that were previously unreachable from the outside.
  • If a subsequent compromise succeeds, check authentication failures/successes, processes, files, and configuration changes on the target device.

Identity / IdP

  • Router UPnP operations do not require authentication. IdP logs will not show anything.
  • If someone logs in to an exposed management screen or business service later, check the authentication logs for that service.

SaaS / Cloud

  • ISP CPE management platforms may contain records of UPnP settings, firmware versions, port forwarding tables, and remote configuration changes.
  • For cloud-managed cameras and similar devices, check for account and settings changes at the same time as direct external connections.

Network

  • WAN to router TCP port 5000 HTTP GET rootDesc.xml, POST /ctl/IPConn
  • Requests where SOAPAction is AddPortMapping, DeletePortMapping, GetGenericPortMappingEntry, or GetExternalIPAddress
  • Connections to newly created external ports and forwarding to corresponding LAN IPs and ports
  • Forwarding rules with a lease duration of 0 or an unknown owner that remain even after the router reboots

9. Attack Success Determination

  • Attack Attempt Observed (Success Unconfirmed): Only scans to WAN-side TCP port 5000, retrieval of rootDesc.xml, and SOAP requests are seen. No setting changes are confirmed.
  • User Action Confirmed: No user action is required. Do not use user action as a success condition.
  • Initial Execution Confirmed: The router returns HTTP 200 for AddPortMapping or DeletePortMapping, and changes appear in the forwarding table.
  • Malware Execution or Authentication Success Confirmed: Malware and authentication are not required. Confirm that a connection is established from the attacker's created external port to an internal LAN service.
  • Information Theft or Session Compromise Confirmed: Retrieval of the existing forwarding table and public IP, or data acquisition and authentication session compromise from the exposed service.
  • Subsequent Compromise Confirmed: Authentication bypass, vulnerability exploitation, configuration changes, code execution, or information theft on the exposed internal device.

10. Investigation Playbook

Trigger

  • Identify assets running Calix GS5239XG / GigaSpire 7u10txg and EXOS 6.6.47.
  • Detect external exposure of WAN-side TCP port 5000.
  • Identify port forwarding rules with unknown owners, especially those with a lease duration of 0.
  • Detect direct connections from internet sources to internal cameras, NAS devices, and IoT devices.

Initial Verification

  • Confirm the router model, firmware, ISP, management privileges, UPnP settings, and public IP.
  • Check if TCP port 5000 is reachable from the WAN side using an authorized diagnostic environment.
  • Compare current port forwarding tables with backups or known good states. Extract suspicious external ports, LAN IPs, descriptions, and lease durations.

Endpoint

  • Identify all LAN devices that became forwarding targets. Determine how long they were exposed and which services were affected.
  • Preserve authentication, access, setting, file, and process logs on the target devices. Check for subsequent connections from external sources.
  • Preserve router settings export, UPnP status, forwarding tables, and firmware information.

Identity / Cloud

  • Change credentials for exposed management screens, NAS devices, cameras, and business services. Revoke sessions.
  • Ask the ISP for CPE management logs, configuration delivery, firmware details, and whether TCP port 5000 can be blocked.
  • For cloud-connected devices, check account activity and API events during the period of external exposure.

Subsequent Operations

  • Track the source IP, connection count, forwarding destination, and traffic volume for new external ports.
  • Check for known vulnerabilities, default credentials, and weak authentication on the forwarded services.
  • Expand the investigation across other locations, remote workers, and contractors who use the same router model.

Containment

  • Disable UPnP and block WAN-side TCP port 5000 at the router, upstream firewall, or ISP level.
  • Delete suspicious forwarding rules. Do not rely on reboots; check the forwarding table again.
  • Isolate and update forwarding target devices. Change credentials and restore only the minimum necessary connections.
  • If a vendor patch is released, apply it and re-verify from the outside that the service is closed on the WAN side.

Determination Levels

  • TCP port 5000 exposed / scan only
  • UPnP service description / forwarding table retrieved
  • Unauthorized port forwarding created / deleted
  • Connection established from outside to internal LAN service
  • Internal device authentication / vulnerability exploitation
  • Code execution / information theft / denial of service

11. Defense and Detection Ideas

Single Events

  • AddPortMapping SOAP request to WAN-side TCP port 5000
  • /ctl/IPConn access from an external source
  • Forwarding rules with a lease duration of 0, an unknown description, or an unknown LAN IP
  • Internet connections to internal services that were never exposed externally before

Time-Series Correlation

  • rootDesc.xml retrieval -> GetGenericPortMappingEntry -> AddPortMapping -> connection to new external port
  • Suspicious SOAP request -> forwarding table change -> internal device authentication attempt -> configuration or file change
  • Router reboot -> same forwarding rule remains -> external connection continues

Threat Hunting Perspectives

  • MiniUPnPd / TCP port 5000 exposed to the WAN side on ISP-managed CPE or branch routers
  • Devices accepting WANIPConnection:1 control from the WAN
  • UPnP forwarding rules with no expiration, unknown owners, or pointing to management interfaces
  • Unexpected external inbound traffic through routers in front of remote work devices or small branch offices

Log Gaps

  • Home or ISP-rented routers may not keep audit logs of SOAP requests and forwarding table changes.
  • NAT-masked LAN endpoint logs cannot recreate the original external ports or router configuration changes.
  • Corporate SOCs may not know the router models, firmware versions, or UPnP status of remote workers' home routers.
  • Contract and privacy restrictions may limit the sharing of ISP logs and customer router settings.

Priority Countermeasures

  • Disable UPnP on affected devices and block WAN-side TCP port 5000.
  • Audit all forwarding rules and delete unnecessary, permanent, or management-screen-targeted rules.
  • Apply strong authentication, updates, and external source restrictions on internal cameras, NAS devices, and IoT devices. Do not rely only on NAT as a defense boundary.
  • Maintain endpoint firewalls and Zero Trust access for remote workers and small branch offices to limit the impact if a home router is compromised.

12. Facts / Inference / Hypothesis

Facts

  • Calix GS5239XG running EXOS 6.6.47 exposes WANIPConnection:1 of MiniUPnPd 2.3.7 on WAN-side TCP port 5000.
  • rootDesc.xml and /ctl/IPConn are reachable from the internet. Four UPnP operations were confirmed without authentication.
  • AddPortMapping can forward any external port to a LAN IP and port.
  • Forwarding rules with a lease duration of 0 remained after a reboot on the researcher's device.
  • CERT/CC could not coordinate with the vendor. There is no patched version and no vendor statement at the time of publication.
  • Researchers tested only their own equipment and reported no active exploitation of third-party systems.

Inference

  • Devices distributed by ISPs with the same firmware and default configuration are likely exploitable if they have a public IP and reachable TCP port 5000.
  • Even if a remote worker's business device is behind the router, endpoint firewalls can reduce direct compromise risk by rejecting external traffic.
  • Cameras, NAS devices, and IoT devices that rely solely on NAT and use weak authentication have a high risk of subsequent compromise.

Hypothesis

  • Internet scans could enumerate vulnerable routers and automatically port forward to internal devices with default credentials or known vulnerabilities.
  • It is unclear if domestic ISPs distribute the exact model and firmware, and actual exposure in Japan has not been confirmed.

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: high) — Exploiting unauthenticated UPnP SOAP services exposed to the WAN side to change router settings.
  • T1562.004 Impair Defenses: Disable or Modify System Firewall (Confidence: high) — Adding or removing NAT and firewall port forwarding rules to change the defense boundary.
  • T1133 External Remote Services (Confidence: low) — Addressing the subsequent stage of reaching internal services from created external ports. Use in actual attacks is not confirmed yet.

14. Unknowns and Additional Investigation

  • Scope of impact on other Calix models, other EXOS versions, and MiniUPnPd configurations
  • Number of devices, regions, and ISPs with actually exposed WAN-side TCP port 5000
  • Presence of active exploitation, scans, attack infrastructure, and internal device compromises
  • Whether routers record SOAP request sources and forwarding table changes, and how to collect logs
  • Whether ISP remote management can disable UPnP, block TCP port 5000, and audit forwarding tables
  • Vendor patch release timing and handling of existing unauthorized forwarding rules after patching
  • Sales, ISP distribution, and usage status in Japan

15. Impact on SOCs and General Organizations

  • Direct confirmation is limited to residential equipment rented by US ISPs. Usage in Japan is unclear, so direct impact on standard domestic enterprises is evaluated as limited.
  • However, if remote workers, small branch offices, overseas offices, or expatriate homes use the same models, corporate terminals or NAS devices could be exposed externally.
  • SOCs must not assume that corporate-managed routers, home offices, and small branches are safe just because they are "behind NAT." They need to maintain endpoint firewalls, strong authentication, and Zero Trust connections.
  • For ISPs and telecommunication providers, CPE model and firmware inventories, WAN-side TCP port 5000 scanning, and bulk disabling of UPnP are high priorities.
  • External attack surface management (ASM) can check TCP port 5000 for company and related branch assets to detect unexpected exposure of internal devices.

16. Summaries by Target Audience

For SOCs

Track WAN-side TCP port 5000 SOAP requests, UPnP forwarding table changes, connections to new external ports, and authentication/compromise of forwarded endpoints in chronological order. Distinguish between forwarding rule creation alone and actual internal device compromise.

For Administrators

Disable UPnP and block TCP port 5000 on Calix GS5239XG / EXOS 6.6.47 routers. Review all port forwarding rules, delete suspicious rules instead of just rebooting, and investigate the forwarding target devices.

For Users

If you rent the affected router from your ISP, disable UPnP in the management settings. If you cannot change settings, ask your ISP for help. Also, check passwords and update statuses for cameras, NAS devices, and similar equipment.

Top comments (0)