CVE-2026-19745

Received Received - Intake

Denial of Service in Calix GigaSpire via Web Interface

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulDB

Description

A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-19745

EUVD

EUVD-2026-58241

Affected Vendors & Products

Vendor	Product	Version / Range
calix	gigaspire	26.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service flaw in Calix GigaSpire 26.1.0. It exists in the Web Management Interface due to an unknown function in utilities_configurationsave.cgi. Manipulating the sessionKey argument can cause the system to crash or become unavailable. The attack can be executed remotely and an exploit has been publicly disclosed.

Impact Analysis

If exploited, this vulnerability could allow an attacker to disrupt the availability of the Calix GigaSpire device. This may result in loss of access to the Web Management Interface, preventing legitimate users from managing the device. The impact is limited to denial of service and does not involve data theft or unauthorized changes.

Compliance Impact

This vulnerability primarily affects availability and does not directly impact data confidentiality or integrity. However, prolonged downtime due to denial of service could lead to non-compliance with availability requirements in regulations like GDPR or HIPAA, which mandate timely access to systems handling sensitive data.

Mitigation Strategies

Immediately restrict access to the Web Management Interface, especially the utilities_configurationsave.cgi endpoint. Update or patch the Calix GigaSpire system if a fix is available. Monitor network traffic for unusual activity targeting this component.

Hi! I’m here to help you understand CVE-2026-19745. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70