CVE-2026-19746

Deferred Deferred - Pending Action

Denial of Service in Calix GigaSpire Firmware

Publication date: 2026-08-13

Last updated on: 2026-10-16

Assigner: VulDB

Description

A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The vendor explains: "After reviewing the researcher's videos, we repeated the test using his described setup: the traceroute cancel request was sent while a second client was connected to the EWI. The second client remained connected and was not interrupted, and we did not observe a forced logout, session invalidation, or loss of EWI availability."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-08-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-19746

EUVD

EUVD-2026-58225

Affected Vendors & Products

Vendor	Product	Version / Range
calix	gigaspire	26.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in Calix GigaSpire version 26.1.0. It involves an unknown function in the traceroute.cmd file that can be manipulated to cause the system to stop responding. The attack can be executed remotely without requiring authentication.

Detection Guidance

Detection may involve monitoring for unusual network traffic or service disruptions related to the traceroute.cmd functionality in Calix GigaSpire 26.1.0. Check for unexpected denial of service events or crashes in network services.

Impact Analysis

If exploited, this vulnerability could disrupt the availability of the Calix GigaSpire device, leading to service outages. This may affect network operations, cause downtime for connected systems, and require manual intervention to restore functionality.

Compliance Impact

The vulnerability causes a denial of service via traceroute.cmd, which may impact system availability. This could affect compliance with standards requiring continuous availability, such as HIPAA for healthcare systems or GDPR for data processing operations, if the affected system is part of regulated infrastructure.

Mitigation Strategies

Immediate steps include isolating affected systems, applying vendor patches if available, or disabling the traceroute.cmd functionality if not required. Monitor vendor communications for updates.

Hi! I’m here to help you understand CVE-2026-19746. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70