Calix fiber gateway takes port-forward orders from anyone, and the vendor has not answered

MiniUPnPd is built to take orders from the inside. The Internet Gateway Device profile exists so that a console or a client on the LAN can ask the router to open a port for itself, and the daemon complies because the request arrived on an interface the router treats as its own. On the GS5239XG running EXOS/6.6.47 firmware, CERT/CC says that WANIPConnection SOAP service is bound to the public WAN interface on TCP port 5000 with no access controls ^[2][3]. Authentication was never part of that design. The interface it listened on was the control, and that control is what went missing.

The verb list is what lifts this above nuisance. Unauthenticated requests can add port mappings, delete existing ones, enumerate what is already configured, and ask the router for its external IP address ^[4]. Enumeration and deletion are the parts that get skipped in summaries: an attacker who can read the mapping table learns what the household has already chosen to expose, and one who can delete entries can break a service the subscriber depends on without ever touching a device inside.

The researcher's own framing is worth quoting because it names the operational property that matters: "One unauthenticated request from anywhere in the world is enough to open a permanent hole through the router's firewall to any device inside the house. No password. No prompt. Nothing on screen. The rule survives a reboot" ^[10].

Inventory is the first place this gets awkward. The affected model is sold as the GS5239XG and also marketed as the GigaSpire 7u10txg, a new premium unit pairing Wi-Fi 7 with an integrated XGS-PON terminal ^[8]. Any asset search keyed to one of those two strings will undercount the fleet, and support records for carrier-supplied CPE rarely agree on which name got typed ^[3].

Then the mitigation. The advice on offer is to switch off UPnP in the gateway's administrative interface under Advanced then Security then UPnP, which also turns off automatic port opening for games that expect it, though specific ports can still be forwarded by hand ^[11][12]. CERT/CC adds that the setting is sometimes locked, in which case the subscriber is told to ask their ISP to disable it ^[13]. That is the whole subscriber-side toolkit, and on a locked unit it is empty ^[1]. What remains is upstream: the vulnerable service is reachable as inbound TCP 5000 on the WAN, so filtering that port at the edge removes reachability without a firmware change ^[2]. That is a decision only Cox, Brightspeed, ALLO and the rest can make, and it is the only one currently available.