Calix GS7 Router Flaw Lets Attackers Expose Home Devices via Unauthenticated UPnP

·8 views

A high-severity vulnerability, tracked as CVE-2026-75501, has been disclosed by CERT/CC affecting the Calix GS7 XGS GS5239XG residential router running EXOS 6.6.47. The flaw stems from MiniUPnPd 2.3.7 exposing UPnP controls on WAN-side TCP port 5000 without any authentication, a service normally restricted to local networks. Remote attackers can send unauthenticated SOAP requests to create persistent port forwarding rules, effectively bypassing NAT and firewall protections to reach internal cameras, NAS devices, and IoT equipment. Critically, forwarding rules set with a zero-second lease duration survive router reboots, meaning exposure persists without user awareness or notification. No active exploitation has been reported yet, and users are advised to disable UPnP on affected devices as no patch has been issued.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

SOCKS5 Proxies Explained: Use Cases, Technical Features, and Provider Comparison

SOCKS5 proxies are network intermediaries that operate at the transport layer, supporting any TCP or UDP protocol — making them more versatile than standard HTTP proxies. They are widely used by developers, marketers, and businesses for tasks such as web scraping, geolocation testing, load testing, and application-specific IP masking. Unlike VPNs, SOCKS5 proxies route only selected application traffic through the proxy server, leaving other system traffic unaffected. Key providers in the market include Bright Data, Oxylabs, Smartproxy, and Proxies.com, which differ in pricing, uptime guarantees, and IP pool types. Choosing the right provider depends on factors such as residential IP availability, SOCKS5 support, cost per gigabyte, and uptime SLA commitments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Iterate Over Strings in Dart Using ASCII and UTF-8 Encoding

Dart strings are not natively iterable and must be converted to a list or iterable class before character-by-character traversal. The dart:convert module provides ascii.encode() and utf8.encode() methods to handle this conversion. However, using utf8.encode() directly on a string splits multi-byte Unicode characters into individual bytes, producing fragmented output. A simpler workaround is to use the built-in String.split('') method, which correctly preserves each Unicode character as a single element in the resulting list. This approach is especially useful when working with non-ASCII characters such as Chinese glyphs or special symbols.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitHub Agentic Workflows Let Developers Automate CI Triage Using Markdown

GitHub Agentic Workflows, currently in public preview, allow developers to define automation logic in Markdown with natural-language instructions that compile into standard GitHub Actions YAML. A tutorial published on DEV Community demonstrates building a CI failure triage workflow that reads failed runs, analyses logs and jobs, and proposes a diagnostic issue for maintainer review. The workflow operates with read-only permissions and uses a staged mode that previews proposed changes in the Actions step summary without writing anything to the repository. Multiple guardrails — including scoped triggers, failure-only conditions, and restricted tool access — keep the agent's reach bounded and protect against risks like prompt injection. The sample was validated using gh-aw v0.86.2 on 25 August 2026, and the feature remains subject to change while in preview.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Baklava Library Generates API Docs and Type-Safe Clients from Scala Routing Tests

Baklava is an open-source Scala library by Iterators that generates API documentation directly from routing tests, eliminating the common problem of documentation drifting out of sync with actual code. When tests run, Baklava observes each request and response to infer the API surface and produce documentation as a test output rather than a separately maintained file. If a route changes and the test breaks, the documentation will not publish until the test is corrected, making drift structurally impossible. The library supports Pekko HTTP and http4s frameworks, integrates with ScalaTest, Specs2, and MUnit, and can output in seven formats including OpenAPI, TypeScript clients, Postman collections, and an sttp Scala client. Baklava v1.4.0 was released in May 2026 under the Apache 2.0 license and is actively maintained by Iterators.

0 comments Read more at DEV Community