The attack vector relies on the router’s handling of specific network requests, which an outsider can exploit without credentials. Once a rule is created, services such as cameras, NAS units, or other IoT gear become reachable from the WAN, potentially giving attackers direct access to sensitive data or a foothold for lateral movement.

• Affected hardware: Calix GS5239XG (GS7 XGS series)
• Required access: Remote, unauthenticated
• Impact: Arbitrary port forwarding, exposing LAN devices to the internet

At the time of this report, there is no official firmware update or advisory from Calix to remediate the issue. Broadband providers using these devices have not issued a coordinated mitigation guide, leaving subscribers exposed until a fix is released.

As a temporary measure, users are advised to:

• Disable remote management features on the router interface.
• Manually review active port-forwarding rules for any unknown entries.
• Monitor network traffic for unsolicited inbound connections.
• Contact their ISP to request an updated device or replacement hardware.

Source: BleepingComputer

With no vendor patch available, how is your organization handling exposure for subscriber-grade CPE devices that rely on NAT as the primary barrier?