Calix gateway takes UPnP orders from the internet, and there is no patch to install

UPnP IGD was never authenticated because the protocol treated network position as the credential: if you could reach the control endpoint, you were already on the LAN. Bind that endpoint to the WAN interface and nothing else is holding the door. The remedy CERT/CC lists is a vendor patch that binds UPnP control to the LAN side only ^[9]. No such firmware exists and the vendor has not commented ^[8].

The sequence is ordinary SOAP. Pull `rootDesc.xml`, locate the `WANIPConnection:1` control endpoint at `/ctl/IPConn`, then call `GetExternalIPAddress` and `GetGenericPortMappingEntry` without credentials ^[3]. That last call is reconnaissance: it hands over the existing mapping table before anything is written. `AddPortMapping` then points any external port at a chosen LAN address and port ^[4]. Set the lease to 0 and the rule does not expire; in researcher tests it survived a reboot of the router ^[5]. The note credits a technical analysis by Brian Khan Quintana among its related sources ^[17].

Persistence across reboot is the part that breaks support process. Power-cycling the gateway is the first instruction on every tier-one script, and here it changes nothing ^[5]. Nor is there a signal to act on: no prompt, no click, no screen, no notification to the subscriber, and normal usage may feel identical ^[11]. CERT/CC also warns that router audit logs alone may not show the source of the request or when the change was made ^[13]. What is left to look at is the forwarding table itself, checked for rules with unknown owners, lease duration 0, or LAN addresses nobody expects, plus whether WAN-side 5000 answers at all ^[12].

The note is disciplined about how far this goes. There are no recorded incidents, and research has not reported active attacks against third-party devices ^[10]. The initial success point is the router settings interface, not code execution on a LAN host ^[16]. Compromising an internal camera, NAS, or management screen still needs that service to have its own flaw, default credentials, or weak authentication ^[15]. What is demonstrated is unauthenticated write access to the NAT and firewall tables of a shipping residential gateway, on the public interface, from anywhere ^[2].

Count the mitigations and notice who holds them. Disable UPnP in management settings, or ask the ISP to do it if settings are locked; block inbound TCP 5000 at the router, a secondary firewall, or the ISP; delete unauthorised rules and harden the exposed devices ^[9]. Every one of those sits with the subscriber or the carrier, and for any subscriber whose gateway UI is locked down, the only route is a phone call ^[9][18]. Edge filtering is the sole option that covers a fleet.

Expect the first ticket to arrive as a fault, not a breach. Additions are silent, but `DeletePortMapping` removes legitimate rules and takes gaming, cameras, and remote access down with them ^[6], which is the one version of this a customer will actually phone about ^[19].