News, updates, trends and the latest
info you need to know about IT

Overview
The Calix GS7 XGS GS5239XG router running firmware EXOS/6.6.47 contains a missing authentication vulnerability that exposes its UPnP (Universal Plug and Play) WANIPConnection service on the public WAN interface.
Description
Calix GS7 XGS GS5239XG is a residential gateway that provides routing, NAT, and firewall functionality for home networks. The device includes the Universal Plug and Play (UPnP) service implemented via MiniUPnPd 2.3.7, a lightweight software program that provides features such as automatic port forwarding for applications and devices on the LAN. By default, the UPnP service is exposed on the device’s WAN interface and does not require authentication.
CVE-2026-75501 In affected firmware versions, the router binds its UPnP WANIPConnection SOAP service to the public WAN interface on TCP port 5000. Because the service does not require authentication when accepting SOAP requests, a remote attacker can obtain full access to the router’s critical UPnP functions including adding, deleting, and enumerating NAT port mappings.
Impact
CVE-2026-75501 enables an unauthenticated, remote attacker to remotely query and manipulate existing NAT mappings. By exploiting this vulnerability to create arbitrary port-forwarding rules on the router, an attacker can bypass NAT and firewall protections, exposing internal LAN devices to the public internet. Because the Calix router is typically provisioned with its default UPnP-enabled configuration, this issue poses significant risk to residential users with network-connected internal devices such as security cameras, network-attached storage (NAS), and other IoT appliances.
Solution
Unfortunately, the CERT/CC was unable to reach Calix to coordinate this vulnerability. Until a vendor patch is available, users can reduce exposure by disabling UPnP on the router’s administrative interface. If the UPnP setting is unavailable or locked, it may be necessary to contact your ISP to request its deactivation at the carrier level. Alternatively, filtering inbound traffic to TCP port 5000, either via the router itself, a secondary firewall, or through your ISP, can prevent external hosts from reaching the WANIPConnection service.
Acknowledgements
Thanks to Brian Khan Quintana for researching and reporting this vulnerability. This document was written by Molly Jaconski.

Overview
RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication, obtain administrative access, cause a denial-of-service condition, or corrupt memory within underlying RDK-B processes. Under certain conditions, this memory corruption may potentially be leveraged for arbitrary code execution.
Description
RDK-B (Reference Design Kit for Broadband) is an open-source software platform used in broadband gateways and related networking devices. The RDK-B WebUI provides a web-based interface for configuring and administering an RDK-B device. Five vulnerabilities have been identified in the RDK-B WebUI.
CVE-2026-19505JWT (JSON Web Token) authentication in javascript-templates/source/jst_functions.c does not correctly verify whether a token’s cryptographic signature is valid. The application treats both a valid signature and an invalid signature as successful verification because it incorrectly checks the return value from OpenSSL’s EVP_VerifyFinal() function.
A remote, unauthenticated attacker can craft a JWT with an invalid signature that is still accepted by the WebUI. Successful exploitation allows the attacker to log in as the privileged user and gain administrative access to the device.
CVE-2026-19506 The login process in /usr/www2/check.jst uses a shared value to store the result of password verification. Because this value is shared between multiple requests, the application may return one user’s authentication result to another user’s session.
An unauthenticated attacker can send a login request at the same time a legitimate administrator logs in. If the requests are timed correctly, the attacker’s session may receive the administrator’s successful authentication result, allowing access to the WebUI without knowing the correct password.
CVE-2026-19507 The login handler in /usr/www2/check.jst does not limit the length of the password submitted by a user. The application performs SHA-256 hashing on the entire supplied password before rejecting the login attempt.
A remote, unauthenticated attacker can submit very large password values to consume excessive CPU resources. Repeated requests can make the WebUI and related services slow or unresponsive, resulting in a denial-of-service condition.
CVE-2026-19508 The data parser in javascript-templates/source/jst_post.c does not properly validate malformed input before processing it in memory. A remote, unauthenticated attacker can send a specially crafted request that causes the Duktape WebUI (https://duktape.org/) process to access or modify memory incorrectly.
During data parser processing and later during Duktape memory cleanup, indicating that application memory can be corrupted. An attacker may be able to use this vulnerability to cause a denial-of-service and potentially execute arbitrary code, although code execution has not been demonstrated.
CVE-2026-19509 The ajaxSet_wireless_network_configuration.jst handler does not properly validate the ssid_number value before passing it to the RDK-B routing service.
An authenticated administrator can supply an abnormally large value that causes memory corruption in the native rtrouted process. This condition can crash rtrouted and trigger an RBus service restart. Successful exploitation can cause a denial-of-service. Because the flaw results in native memory corruption, arbitrary code execution may also be possible.
Impact
A remote, unauthenticated attacker with network access to the RDK-B WebUI may be able to bypass authentication and obtain administrative access to the device. An unauthenticated attacker may also cause memory corruption or resource exhaustion, resulting in denial-of-service.
An authenticated administrator may be able to trigger memory corruption in the privileged rtrouted process and result in arbitrary code execution.
Successful exploitation of one or more of these vulnerabilities could result in unauthorized administrative access, modification of device configuration, loss of availability, or potentially execution of attacker-controlled code on an affected device.
Solution
Unfortunately, RDK Central was unreachable to coordinate these vulnerabilities. Until an update is available, administrators should restrict access to the RDK-B WebUI to trusted management networks and authorized hosts. The administrative interface should not be exposed directly to the Internet or other untrusted networks.
Acknowledgements
Thanks to Mikołaj Pisula and Michał Bernacki for researching and reporting these vulnerabilities. This document was written by Michael Bragg.

Overview
Two vulnerabilities have been identified in the Trusted Platform Module (TPM) 2.0 reference implementation:

CVE-2026-6726 – Information leakage via falsified TPM keys.
CVE-2026-6727 – A timing side-channel vulnerability in RSA OAEP decryption.

An attacker with privileged access to a TPM command interface may be able to exploit these vulnerabilities by sending specially crafted TPM commands. Successful exploitation could allow the attacker to decrypt ciphertexts encrypted to affected TPM-managed RSA keys, including the RSA Endorsement Key (EK), or obtain credentials for falsified TPM keys, enabling forged TPM 2.0 attestations.
These vulnerabilities are also documented by the Trusted Computing Group (TCG) in advisories – TCGVRT010 and TCGVRT0011:
Description
Trusted Platform Module (TPM) technology provides hardware-backed cryptographic services for modern computing platforms. TPMs are designed to resist tampering and may be implemented as discrete chips, integrated hardware, firmware-based TPMs (fTPMs), or software implementations used in cloud and virtualized environments.
The Trusted Computing Group (TCG) maintains the TPM specifications and publishes a reference implementation to assist vendors in developing TPM-compliant products.
Two vulnerabilities were identified in the TPM 2.0 reference implementation.
CVE-2026-6727
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations.
CVE-2026-6726
An information leakage vulnerability could allow a privileged local attacker to obtain credentials from a TPM-aware Certificate Authority (CA) for a falsified TPM key, such as an Attestation Key (AK), DevID key, or TLS authentication key. This could enable the creation of fraudulent TPM 2.0 attestations using the forged key.
Both vulnerabilities require privileged access to the TPM command interface. Multiple vendors have released firmware and software updates incorporating fixes from the updated TPM 2.0 reference implementation.
Impact
Successful exploitation requires privileged local access to a TPM command interface. Depending on the vulnerability exploited, an attacker may be able to:
– Decrypt ciphertexts encrypted to the TPM-managed RS keys, including the RSA Endorsement Key (EK), , including credential blobs, import blobs, and session salts.
– Obtain credentials for falsified TPM keys.
– Produce fraudulent TPM 2.0 attestations that appear to originate from a legitimate TPM.
The overall impact depends on the affected TPM implementation and how TPM-based attestation and key management are used by the platform.
Solution
The vulnerabilities originate in the TPM 2.0 reference implementation, and TPM vendors have incorporated the corresponding fixes into updated firmware and software releases. Users should install TPM firmware updates, operating system updates, or software patches provided by their platform or TPM vendor.
Cloud providers using software-based TPM implementations may also have deployed updates. Customers should consult their cloud provider’s guidance to determine whether any additional action is required. See the Vendor Information section for product-specific remediation guidance.
Acknowledgements
Thanks to security researchers Liran Perez, Zecharye Galitzky, Shai Sarfati, and Yanai Moyal from Intel for reporting these vulnerabilities. Thanks to members of the Trusted Computing Group’s Vulnerability Response Team, TCG VRT, for working with CERT/CC towards this multi-party vulnerability disclosure. This document was written by Vijay Sarvepalli.