Unpatched Calix UPnP flaw exposes WAN SOAP on port 5000

CVE-2026-75501 is a missing-authentication bug in Calix GS7 XGS gateways on EXOS/6.6.47. MiniUPnPd’s WANIPConnection SOAP interface listens on WAN TCP 5000.

Cover image from BleepingComputer’s report on the Calix UPnP WAN flaw

On August 24 BleepingComputer reported CVE-2026-75501, a missing-authentication flaw in Calix GS7 XGS gateways — models GS5239XG and GigaSpire 7u10txg — running EXOS/6.6.47. MiniUPnPd’s WANIPConnection SOAP interface is reachable on WAN TCP port 5000. There was no patch at publication.

What we know

CVE-2026-75501 is missing authentication on Calix GS7 XGS (GS5239XG / GigaSpire 7u10txg) running EXOS/6.6.47.
MiniUPnPd exposes WANIPConnection SOAP on WAN TCP 5000.
Researcher Brian Khan Quintana found a no-expiry mapping that survived reboot.
He notified Calix on June 7 and then CERT/CC.
The hardware is used by Cox, Brightspeed, ALLO, CityFibre, and Conexon. The workaround is to disable UPnP; no patch was available at publication.

Takeaways

The SOAP control plane is on the WAN, not only behind NAT.
A mapping that outlives reboot is a durable hole, not a one-shot leak.
Operators are being told to turn UPnP off while they wait for a patch.

Source: BleepingComputer

Related reading

Image published with BleepingComputer on exploited Gitea CVE-2026-60004

SecurityAug 263 min read

CISA says attackers are exploiting a critical Gitea code-injection flaw

CISA says CVE-2026-60004 is being exploited on self-hosted Gitea: a critical code injection in the diffpatch API. Default open registration lets an unauthenticated visitor create an account and repository, then run commands as the gitea user.

Image published with SiliconANGLE on the Nvidia NemoClaw CVE-2026-65105 flaw

SecurityAug 253 min read

NemoClaw flaw let a malicious site poison a developer’s local Ollama model

Oasis Security’s CVE-2026-65105 says one visit to a malicious site can take control of the local Ollama instance behind Nvidia’s NemoClaw agent. Ollama binds on 0.0.0.0:11434, and the Host check is skipped when the bind address is not loopback.

Image published with BleepingComputer on npm and UNPKG phishing pages

SecurityAug 253 min read

Attackers abuse npm and UNPKG to host phishing redirect pages

OX Security found 24 npm packages that contain only malicious HTML impersonating a Cloudflare Turnstile check. UNPKG copied the files, so opening the HTML from the trusted mirror can redirect a visitor.

All of Pulse

SecurityAugust 24, 20263 min read

Unpatched Calix UPnP flaw exposes WAN SOAP on port 5000

CVE-2026-75501 is a missing-authentication bug in Calix GS7 XGS gateways on EXOS/6.6.47. MiniUPnPd’s WANIPConnection SOAP interface listens on WAN TCP 5000.

What we know

CVE-2026-75501 is missing authentication on Calix GS7 XGS (GS5239XG / GigaSpire 7u10txg) running EXOS/6.6.47.
MiniUPnPd exposes WANIPConnection SOAP on WAN TCP 5000.
Researcher Brian Khan Quintana found a no-expiry mapping that survived reboot.
He notified Calix on June 7 and then CERT/CC.
The hardware is used by Cox, Brightspeed, ALLO, CityFibre, and Conexon. The workaround is to disable UPnP; no patch was available at publication.

Takeaways

The SOAP control plane is on the WAN, not only behind NAT.
A mapping that outlives reboot is a durable hole, not a one-shot leak.
Operators are being told to turn UPnP off while they wait for a patch.

Source: BleepingComputer