Unauthenticated Port Forwarding Modification in Calix EXOS GS7

Executive Summary

This vulnerability is in the Calix EXOS firmware for the GS7 XGS residential router. It allows unauthenticated remote attackers to modify NAT port-forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without access controls. Attackers can send crafted requests to add, delete, or enumerate port mappings or query the external IP address without authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if TCP port 5000 is open on your router's WAN interface. Use a port scanner like nmap to scan your public IP for port 5000. If the port responds, the UPnP service may be exposed. Example command: nmap -p 5000 <your_public_ip>. Alternatively, check router logs for unauthorized port mapping changes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to bypass the firewall and NAT boundary, exposing internal LAN services to the public internet. Attackers could open permanent holes in the router's firewall, granting direct access to devices like security cameras, baby monitors, or work laptops without requiring a password or user interaction.

Useful 0 Not Useful 0

Mitigation Strategies

Disable UPnP on the router via its administrative interface. If unavailable, contact your ISP to disable UPnP at the carrier level. Block inbound traffic to TCP port 5000 using firewall rules. Avoid relying on vendor patches as none are currently available.

Useful 0 Not Useful 0