Loading story…
An unpatched vulnerability in Calix GS7 XGS residential routers allows remote, unauthenticated attackers to create and manage port-forwarding rules from the public internet, exposing devices on the internal network. Tracked as CVE-2026-75501, the issue affects the GS5239XG/GigaSpire 7u10txg running EXOS/6.6.47 and stems from the MiniUPnPd WANIPConnection SOAP service being exposed on the WAN interface over TCP port 5000 without authentication or access controls.
The flaw can be abused to bypass NAT and firewall protections and publish internal services such as cameras, NAS systems, administrative interfaces, and IoT devices; researchers reported that a single unauthenticated request can create persistent port mappings that survive reboot. Security researcher Brian Khan Quintana disclosed the issue through CERT/CC after unsuccessful attempts to reach Calix, and no vendor patch was available at publication time. Recommended mitigations were to disable UPnP or ask the ISP to disable it where the setting is locked.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Brian Khan Quintana published technical details showing that the MiniUPnPd WANIPConnection SOAP service was exposed on the WAN interface over TCP port 5000 without authentication. The disclosure described how remote attackers could create persistent port-forwarding rules and expose internal devices by bypassing NAT and firewall protections.
After receiving no response from Calix, Brian Khan Quintana reported the issue to Carnegie Mellon CERT/CC. CERT/CC then coordinated public disclosure after multiple unsuccessful attempts to contact the vendor.
Brian Khan Quintana attempted to notify Calix about the vulnerability affecting Calix GS7 XGS routers. The sources explicitly anchor this outreach to June 7, but do not provide a year.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcemkd-cirt.mk
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Centre for Cybersecurity Belgium warned of a **critical OS command injection** vulnerability affecting **Zyxel EX3510-B0** routers’ UPnP functionality, tracked as **CVE-2025-13942** (CVSS 3.1 **9.8**, **CWE-78**). Successful exploitation could allow an unauthenticated remote attacker to execute OS commands by sending **specially crafted UPnP SOAP requests**, potentially leading to full device compromise. Zyxel published a security advisory covering this issue and recommended customers apply vendor updates; the Belgian advisory similarly urged **immediate patching** and increased monitoring, noting that updating does not remediate any **prior compromise**. Separately, Zyxel also disclosed a related but distinct command injection issue in a different model—**CVE-2025-13943** in **EX3301-T0**—which requires authentication and is triggered via the log file download function, and should be tracked and remediated as a separate vulnerability from the EX3510-B0 UPnP flaw.
Jun 29, 2026
A critical vulnerability, **CVE-2025-13184**, in the **TOTOLINK X5000R (AX1800)** home router allows an attacker with access to the device’s management interface—or physical access to the router—to enable **Telnet** without authentication and log in as **root** with no password. The flaw was confirmed in firmware version `V9.1.0u.6369_B20230113`, and earlier versions may also be affected. Publicly known exploitation can lead to full device compromise, arbitrary code execution, configuration tampering, traffic manipulation, exposure of sensitive network data, botnet enrollment, and lateral movement to other devices on the local network. No vendor patch was reported as available at the time of publication, prompting guidance to treat the X5000R as untrusted from an access-control perspective and avoid connecting it directly to the internet. Recommended mitigations include keeping the management panel inaccessible from the public internet, verifying network segmentation and cabling, replacing the firmware with an alternative such as **OpenWrt** where feasible, or removing and securely disposing of the device if the risk cannot be managed. A key indicator of compromise is **TCP port 23** being open on the router, suggesting Telnet has been enabled maliciously.
Jun 29, 2026
Zyxel has released firmware updates for **CVE-2026-7273**, a stack-based buffer overflow in the CGI component of **GS1900 series** switch firmware that can let a LAN-based, unauthenticated attacker send a crafted HTTP request and potentially execute operating system commands on affected devices. The flaw carries a **CVSS 8.8** rating and is classified as **`CWE-121`**, with impact to confidentiality, integrity, and availability; public references specifically note exposure in models across the GS1900 line, including devices such as the **GS1900-8**, **GS1900-24**, **GS1900-48HPv2**, and other units running firmware **2.90 or earlier** in their respective branches.
Jun 29, 2026