Unpatched Calix flaw lets hackers bypass NAT to expose internal devices
-
A vulnerability in the Calix GS7 XGS (GS5239XG) residential routers, commonly deployed by multiple U.S. broadband providers, remains unpatched and allows remote attackers to bypass NAT protections. The flaw enables unauthenticated actors to inject port-forwarding rules, effectively exposing internal devices to the public internet without any user interaction.
The attack vector relies on the router’s handling of specific network requests, which an outsider can exploit without credentials. Once a rule is created, services such as cameras, NAS units, or other IoT gear become reachable from the WAN, potentially giving attackers direct access to sensitive data or a foothold for lateral movement.
- Affected hardware: Calix GS5239XG (GS7 XGS series)
- Required access: Remote, unauthenticated
- Impact: Arbitrary port forwarding, exposing LAN devices to the internet
At the time of this report, there is no official firmware update or advisory from Calix to remediate the issue. Broadband providers using these devices have not issued a coordinated mitigation guide, leaving subscribers exposed until a fix is released.
As a temporary measure, users are advised to:
- Disable remote management features on the router interface.
- Manually review active port-forwarding rules for any unknown entries.
- Monitor network traffic for unsolicited inbound connections.
- Contact their ISP to request an updated device or replacement hardware.
Source: BleepingComputer
With no vendor patch available, how is your organization handling exposure for subscriber-grade CPE devices that rely on NAT as the primary barrier?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login