Search
Find a vulnerability
Search criteria
16 vulnerabilities by Calix
CVE-2026-75501 (GCVE-0-2026-75501)
Vulnerability from nvd – Published: 2026-08-21 14:47 – Updated: 2026-09-15 19:44
VLAI
EPSS
VEX
Vendor could not replicate the vul, and reporter is unavailable to comment.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-09-15T19:44:44.285Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"rejectedReasons": [
{
"lang": "en",
"value": "Vendor could not replicate the vul, and reporter is unavailable to comment."
}
],
"x_generator": {
"engine": "cveClient/1.0.25"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-75501",
"datePublished": "2026-08-21T14:47:04.279Z",
"dateRejected": "2026-09-15T19:44:44.285Z",
"dateReserved": "2026-08-17T20:36:51.717Z",
"dateUpdated": "2026-09-15T19:44:44.285Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19746 (GCVE-0-2026-19746)
Vulnerability from nvd – Published: 2026-08-13 19:15 – Updated: 2026-10-16 06:04 Disputed
VLAI
EPSS
VEX
Title
Calix GigaSpire traceroute.cmd denial of service
Summary
A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The vendor explains: "After reviewing the researcher's videos, we repeated the test using his described setup: the traceroute cancel request was sent while a second client was connected to the EWI. The second client remained connected and was not interrupted, and we did not observe a forced logout, session invalidation, or loss of EWI availability."
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 19:25 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389484 | vdb-entry |
| https://vuldb.com/vuln/389484/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19746 | third-party-advisory |
| https://vuldb.com/submit/868299 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19746",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T19:25:19.686869Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T19:26:06.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:calix:gigaspire:*:*:*:*:*:*:*:*"
],
"product": "GigaSpire",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "26.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The vendor explains: \"After reviewing the researcher\u0027s videos, we repeated the test using his described setup: the traceroute cancel request was sent while a second client was connected to the EWI. The second client remained connected and was not interrupted, and we did not observe a forced logout, session invalidation, or loss of EWI availability.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T06:04:51.525Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389484 | Calix GigaSpire traceroute.cmd denial of service",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/389484"
},
{
"name": "VDB-389484 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389484/cti"
},
{
"name": "CVE-2026-19746 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19746"
},
{
"name": "Submit #868299 | Calix GigaSpire (BLAST series) 26.1.0 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868299"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-16T08:09:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "Calix GigaSpire traceroute.cmd denial of service",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19746",
"datePublished": "2026-08-13T19:15:07.554Z",
"dateReserved": "2026-08-13T14:25:14.108Z",
"dateUpdated": "2026-10-16T06:04:51.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19745 (GCVE-0-2026-19745)
Vulnerability from nvd – Published: 2026-08-13 19:00 – Updated: 2026-10-16 06:04 Disputed
VLAI
EPSS
VEX
Title
Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service
Summary
A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The existence of this vulnerability is still disputed at present. The vendor explains: "We reproduced the reported request pattern. The observed delay results from expected input-timeout handling while the handler waits for input data. We did not observe a backend crash, resource exhaustion, service instability, or loss of EWI availability, and the interface remained accessible during and after testing."
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:40 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389483 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389483/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19745 | third-party-advisory |
| https://vuldb.com/submit/868298 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19745",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:40:06.855802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:40:19.435Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:calix:gigaspire:*:*:*:*:*:*:*:*"
],
"modules": [
"Web Management Interface"
],
"product": "GigaSpire",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "26.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The existence of this vulnerability is still disputed at present. The vendor explains: \"We reproduced the reported request pattern. The observed delay results from expected input-timeout handling while the handler waits for input data. We did not observe a backend crash, resource exhaustion, service instability, or loss of EWI availability, and the interface remained accessible during and after testing.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T06:04:47.985Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389483 | Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389483"
},
{
"name": "VDB-389483 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389483/cti"
},
{
"name": "CVE-2026-19745 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19745"
},
{
"name": "Submit #868298 | Calix GigaSpire (BLAST series) 26.1.0 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868298"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-16T08:09:26.000Z",
"value": "VulDB entry last update"
}
],
"title": "Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19745",
"datePublished": "2026-08-13T19:00:08.612Z",
"dateReserved": "2026-08-13T14:25:09.687Z",
"dateUpdated": "2026-10-16T06:04:47.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-54084 (GCVE-0-2025-54084)
Vulnerability from nvd – Published: 2025-09-09 20:37 – Updated: 2025-09-12 13:59
VLAI
EPSS
VEX
Title
Calix Gigacenter ONT - Command Injection
Summary
OS Command ('OS Command Injection') vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows authenticated attackers with 'super' user credentials to execute arbitrary OS commands through improper input validation, potentially leading to full system compromise.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 15:55 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
Fluid Attacks
CNA
References
3 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/bacalao | third-party-advisory |
| https://www.calix.com | productrelated |
| https://revers3everything.com/calix-case-five-0-d… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Calix | GigaCenter ONT |
Affected:
844E
(custom)
Affected: 844G (custom) Affected: 844GE (custom) Affected: 854GE (custom) cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-54084",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T15:55:26.837997Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T15:55:56.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://fluidattacks.com/advisories/bacalao"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Quantenna SoC"
],
"product": "GigaCenter ONT",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "844E",
"versionType": "custom"
},
{
"status": "affected",
"version": "844G",
"versionType": "custom"
},
{
"status": "affected",
"version": "844GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "854GE",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OS Command (\u0027OS Command Injection\u0027) vulnerability in Calix GigaCenter ONT (Quantenna SoC modules)\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eallows authenticated attackers with \u0027super\u0027 user credentials to execute arbitrary OS commands through improper input validation, potentially leading to full system compromise.\u003c/span\u003e\u003cp\u003eThis issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.\u003c/p\u003e"
}
],
"value": "OS Command (\u0027OS Command Injection\u0027) vulnerability in Calix GigaCenter ONT (Quantenna SoC modules)\u00a0allows authenticated attackers with \u0027super\u0027 user credentials to execute arbitrary OS commands through improper input validation, potentially leading to full system compromise.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-12T13:59:00.965Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/bacalao"
},
{
"tags": [
"product",
"related"
],
"url": "https://www.calix.com"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://revers3everything.com/calix-case-five-0-days-five-cves/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Calix Gigacenter ONT - Command Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2025-54084",
"datePublished": "2025-09-09T20:37:28.023Z",
"dateReserved": "2025-07-16T15:11:01.685Z",
"dateUpdated": "2025-09-12T13:59:00.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-54083 (GCVE-0-2025-54083)
Vulnerability from nvd – Published: 2025-09-09 20:29 – Updated: 2025-09-12 13:58
VLAI
EPSS
VEX
Title
Calix GigaCenter ONT firmware - Sensitive Information Disclosure
Summary
Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 14:03 UTC
CWE
- CWE-922 - Insecure Storage of Sensitive Information
Assigner
Fluid Attacks
CNA
References
3 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/rocola | third-party-advisory |
| https://www.calix.com | relatedproduct |
| https://revers3everything.com/calix-case-five-0-d… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Calix | GigaCenter ONT |
Affected:
844E
(custom)
Affected: 844G (custom) Affected: 844GE (custom) Affected: 854GE (custom) cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-54083",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T14:03:54.440582Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T14:28:53.302Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://fluidattacks.com/advisories/rocola"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Quantenna SoC"
],
"product": "GigaCenter ONT",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "844E",
"versionType": "custom"
},
{
"status": "affected",
"version": "844G",
"versionType": "custom"
},
{
"status": "affected",
"version": "844GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "854GE",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.\u003cp\u003eThis issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.\u003c/p\u003e"
}
],
"value": "Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-922",
"description": "CWE-922 Insecure Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-12T13:58:21.007Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/rocola"
},
{
"tags": [
"related",
"product"
],
"url": "https://www.calix.com"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://revers3everything.com/calix-case-five-0-days-five-cves/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Calix GigaCenter ONT firmware - Sensitive Information Disclosure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2025-54083",
"datePublished": "2025-09-09T20:29:17.196Z",
"dateReserved": "2025-07-16T15:11:01.684Z",
"dateUpdated": "2025-09-12T13:58:21.007Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-7635 (GCVE-0-2025-7635)
Vulnerability from nvd – Published: 2025-09-09 20:08 – Updated: 2025-09-12 13:56
VLAI
EPSS
VEX
Title
Calix GigaCenter ONT - Unauthenticated Telnet
Summary
Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 13:42 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
Fluid Attacks
CNA
References
3 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/sal | third-party-advisory |
| https://www.calix.com | productrelated |
| https://revers3everything.com/calix-case-five-0-d… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Calix | GigaCenter ONT |
Affected:
844E
Affected: 844G Affected: 844GE Affected: 854GE cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7635",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T13:42:42.694051Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T13:42:48.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://fluidattacks.com/advisories/sal"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Quantenna SoC"
],
"product": "GigaCenter ONT",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "844E"
},
{
"status": "affected",
"version": "844G"
},
{
"status": "affected",
"version": "844GE"
},
{
"status": "affected",
"version": "854GE"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.\u003cp\u003eThis issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.\u003c/p\u003e"
}
],
"value": "Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-12T13:56:22.271Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/sal"
},
{
"tags": [
"product",
"related"
],
"url": "https://www.calix.com"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://revers3everything.com/calix-case-five-0-days-five-cves/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Calix GigaCenter ONT - Unauthenticated Telnet",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2025-7635",
"datePublished": "2025-09-09T20:08:37.767Z",
"dateReserved": "2025-07-14T12:49:39.283Z",
"dateUpdated": "2025-09-12T13:56:22.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-53914 (GCVE-0-2025-53914)
Vulnerability from nvd – Published: 2025-09-09 19:59 – Updated: 2025-09-12 13:55
VLAI
EPSS
VEX
Title
Calix GigaCenter ONT (Broadcom SoC) - Excessive Privileges
Summary
Excessive Privileges vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 20:19 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
Fluid Attacks
CNA
References
3 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/sheivi | third-party-advisory |
| https://www.calix.com | productrelated |
| https://revers3everything.com/calix-case-five-0-d… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Calix | GigaCenter ONT |
Affected:
844E
(custom)
Affected: 844G (custom) Affected: 844GE (custom) Affected: 854GE (custom) Affected: 812G (custom) Affected: 813G (custom) Affected: 818G (custom) cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:812g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:813g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:818g:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53914",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T20:19:13.956112Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T20:19:24.548Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Broadcom SoC"
],
"product": "GigaCenter ONT",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "844E",
"versionType": "custom"
},
{
"status": "affected",
"version": "844G",
"versionType": "custom"
},
{
"status": "affected",
"version": "844GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "854GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "812G",
"versionType": "custom"
},
{
"status": "affected",
"version": "813G",
"versionType": "custom"
},
{
"status": "affected",
"version": "818G",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:812g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:813g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:818g:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Excessive Privileges\u0026nbsp;vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.\u003cp\u003eThis issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G.\u003c/p\u003e"
}
],
"value": "Excessive Privileges\u00a0vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-12T13:55:32.373Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/sheivi"
},
{
"tags": [
"product",
"related"
],
"url": "https://www.calix.com"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://revers3everything.com/calix-case-five-0-days-five-cves/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Calix GigaCenter ONT (Broadcom SoC) - Excessive Privileges",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2025-53914",
"datePublished": "2025-09-09T19:59:27.381Z",
"dateReserved": "2025-07-11T22:32:54.176Z",
"dateUpdated": "2025-09-12T13:55:32.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-53913 (GCVE-0-2025-53913)
Vulnerability from nvd – Published: 2025-09-09 19:54 – Updated: 2025-09-12 13:54
VLAI
EPSS
VEX
Title
Calix GigaCenter ONT (Quantenna SoC) - Excessive Privileges
Summary
Excessive Privileges vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 20:16 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
Fluid Attacks
CNA
References
3 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/forty | third-party-advisory |
| https://www.calix.com | productrelated |
| https://revers3everything.com/calix-case-five-0-d… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Calix | GigaCenter ONT |
Affected:
844E
(custom)
Affected: 844G (custom) Affected: 844GE (custom) Affected: 854GE (custom) Affected: 812G (custom) Affected: 813G (custom) Affected: 818G (custom) cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:812g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:813g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:818g:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53913",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T20:16:27.480729Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T20:16:37.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Quantenna SoC"
],
"product": "GigaCenter ONT",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "844E",
"versionType": "custom"
},
{
"status": "affected",
"version": "844G",
"versionType": "custom"
},
{
"status": "affected",
"version": "844GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "854GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "812G",
"versionType": "custom"
},
{
"status": "affected",
"version": "813G",
"versionType": "custom"
},
{
"status": "affected",
"version": "818G",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:812g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:813g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:818g:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Excessive Privileges vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows Privilege Abuse.\u003cp\u003eThis issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G.\u003c/p\u003e"
}
],
"value": "Excessive Privileges vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-12T13:54:40.859Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/forty"
},
{
"tags": [
"product",
"related"
],
"url": "https://www.calix.com"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://revers3everything.com/calix-case-five-0-days-five-cves/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Calix GigaCenter ONT (Quantenna SoC) - Excessive Privileges",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2025-53913",
"datePublished": "2025-09-09T19:54:01.838Z",
"dateReserved": "2025-07-11T22:32:54.176Z",
"dateUpdated": "2025-09-12T13:54:40.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-75501 (GCVE-0-2026-75501)
Vulnerability from cvelistv5 – Published: 2026-08-21 14:47 – Updated: 2026-09-15 19:44
VLAI
EPSS
VEX
Vendor could not replicate the vul, and reporter is unavailable to comment.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-09-15T19:44:44.285Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"rejectedReasons": [
{
"lang": "en",
"value": "Vendor could not replicate the vul, and reporter is unavailable to comment."
}
],
"x_generator": {
"engine": "cveClient/1.0.25"
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2026-75501",
"datePublished": "2026-08-21T14:47:04.279Z",
"dateRejected": "2026-09-15T19:44:44.285Z",
"dateReserved": "2026-08-17T20:36:51.717Z",
"dateUpdated": "2026-09-15T19:44:44.285Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19746 (GCVE-0-2026-19746)
Vulnerability from cvelistv5 – Published: 2026-08-13 19:15 – Updated: 2026-10-16 06:04 Disputed
VLAI
EPSS
VEX
Title
Calix GigaSpire traceroute.cmd denial of service
Summary
A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The vendor explains: "After reviewing the researcher's videos, we repeated the test using his described setup: the traceroute cancel request was sent while a second client was connected to the EWI. The second client remained connected and was not interrupted, and we did not observe a forced logout, session invalidation, or loss of EWI availability."
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 19:25 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389484 | vdb-entry |
| https://vuldb.com/vuln/389484/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19746 | third-party-advisory |
| https://vuldb.com/submit/868299 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19746",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T19:25:19.686869Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T19:26:06.261Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:calix:gigaspire:*:*:*:*:*:*:*:*"
],
"product": "GigaSpire",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "26.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The presence of this vulnerability remains uncertain at this time. The vendor explains: \"After reviewing the researcher\u0027s videos, we repeated the test using his described setup: the traceroute cancel request was sent while a second client was connected to the EWI. The second client remained connected and was not interrupted, and we did not observe a forced logout, session invalidation, or loss of EWI availability.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T06:04:51.525Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389484 | Calix GigaSpire traceroute.cmd denial of service",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/389484"
},
{
"name": "VDB-389484 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389484/cti"
},
{
"name": "CVE-2026-19746 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19746"
},
{
"name": "Submit #868299 | Calix GigaSpire (BLAST series) 26.1.0 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868299"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-16T08:09:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "Calix GigaSpire traceroute.cmd denial of service",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19746",
"datePublished": "2026-08-13T19:15:07.554Z",
"dateReserved": "2026-08-13T14:25:14.108Z",
"dateUpdated": "2026-10-16T06:04:51.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19745 (GCVE-0-2026-19745)
Vulnerability from cvelistv5 – Published: 2026-08-13 19:00 – Updated: 2026-10-16 06:04 Disputed
VLAI
EPSS
VEX
Title
Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service
Summary
A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The existence of this vulnerability is still disputed at present. The vendor explains: "We reproduced the reported request pattern. The observed delay results from expected input-timeout handling while the handler waits for input data. We did not observe a backend crash, resource exhaustion, service instability, or loss of EWI availability, and the interface remained accessible during and after testing."
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:40 UTC
CWE
- CWE-404 - Denial of Service
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/389483 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/389483/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19745 | third-party-advisory |
| https://vuldb.com/submit/868298 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19745",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:40:06.855802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:40:19.435Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:calix:gigaspire:*:*:*:*:*:*:*:*"
],
"modules": [
"Web Management Interface"
],
"product": "GigaSpire",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "26.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The existence of this vulnerability is still disputed at present. The vendor explains: \"We reproduced the reported request pattern. The observed delay results from expected input-timeout handling while the handler waits for input data. We did not observe a backend crash, resource exhaustion, service instability, or loss of EWI availability, and the interface remained accessible during and after testing.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T06:04:47.985Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-389483 | Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/389483"
},
{
"name": "VDB-389483 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/389483/cti"
},
{
"name": "CVE-2026-19745 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19745"
},
{
"name": "Submit #868298 | Calix GigaSpire (BLAST series) 26.1.0 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/868298"
}
],
"tags": [
"disputed"
],
"timeline": [
{
"lang": "en",
"time": "2026-08-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-16T08:09:26.000Z",
"value": "VulDB entry last update"
}
],
"title": "Calix GigaSpire Web Management utilities_configurationsave.cgi denial of service",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19745",
"datePublished": "2026-08-13T19:00:08.612Z",
"dateReserved": "2026-08-13T14:25:09.687Z",
"dateUpdated": "2026-10-16T06:04:47.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-54084 (GCVE-0-2025-54084)
Vulnerability from cvelistv5 – Published: 2025-09-09 20:37 – Updated: 2025-09-12 13:59
VLAI
EPSS
VEX
Title
Calix Gigacenter ONT - Command Injection
Summary
OS Command ('OS Command Injection') vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows authenticated attackers with 'super' user credentials to execute arbitrary OS commands through improper input validation, potentially leading to full system compromise.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 15:55 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
Fluid Attacks
CNA
References
3 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/bacalao | third-party-advisory |
| https://www.calix.com | productrelated |
| https://revers3everything.com/calix-case-five-0-d… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Calix | GigaCenter ONT |
Affected:
844E
(custom)
Affected: 844G (custom) Affected: 844GE (custom) Affected: 854GE (custom) cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-54084",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T15:55:26.837997Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T15:55:56.704Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://fluidattacks.com/advisories/bacalao"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Quantenna SoC"
],
"product": "GigaCenter ONT",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "844E",
"versionType": "custom"
},
{
"status": "affected",
"version": "844G",
"versionType": "custom"
},
{
"status": "affected",
"version": "844GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "854GE",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OS Command (\u0027OS Command Injection\u0027) vulnerability in Calix GigaCenter ONT (Quantenna SoC modules)\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eallows authenticated attackers with \u0027super\u0027 user credentials to execute arbitrary OS commands through improper input validation, potentially leading to full system compromise.\u003c/span\u003e\u003cp\u003eThis issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.\u003c/p\u003e"
}
],
"value": "OS Command (\u0027OS Command Injection\u0027) vulnerability in Calix GigaCenter ONT (Quantenna SoC modules)\u00a0allows authenticated attackers with \u0027super\u0027 user credentials to execute arbitrary OS commands through improper input validation, potentially leading to full system compromise.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-12T13:59:00.965Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/bacalao"
},
{
"tags": [
"product",
"related"
],
"url": "https://www.calix.com"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://revers3everything.com/calix-case-five-0-days-five-cves/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Calix Gigacenter ONT - Command Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2025-54084",
"datePublished": "2025-09-09T20:37:28.023Z",
"dateReserved": "2025-07-16T15:11:01.685Z",
"dateUpdated": "2025-09-12T13:59:00.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-54083 (GCVE-0-2025-54083)
Vulnerability from cvelistv5 – Published: 2025-09-09 20:29 – Updated: 2025-09-12 13:58
VLAI
EPSS
VEX
Title
Calix GigaCenter ONT firmware - Sensitive Information Disclosure
Summary
Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 14:03 UTC
CWE
- CWE-922 - Insecure Storage of Sensitive Information
Assigner
Fluid Attacks
CNA
References
3 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/rocola | third-party-advisory |
| https://www.calix.com | relatedproduct |
| https://revers3everything.com/calix-case-five-0-d… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Calix | GigaCenter ONT |
Affected:
844E
(custom)
Affected: 844G (custom) Affected: 844GE (custom) Affected: 854GE (custom) cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-54083",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T14:03:54.440582Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T14:28:53.302Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://fluidattacks.com/advisories/rocola"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Quantenna SoC"
],
"product": "GigaCenter ONT",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "844E",
"versionType": "custom"
},
{
"status": "affected",
"version": "844G",
"versionType": "custom"
},
{
"status": "affected",
"version": "844GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "854GE",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.\u003cp\u003eThis issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.\u003c/p\u003e"
}
],
"value": "Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-922",
"description": "CWE-922 Insecure Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-12T13:58:21.007Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/rocola"
},
{
"tags": [
"related",
"product"
],
"url": "https://www.calix.com"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://revers3everything.com/calix-case-five-0-days-five-cves/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Calix GigaCenter ONT firmware - Sensitive Information Disclosure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2025-54083",
"datePublished": "2025-09-09T20:29:17.196Z",
"dateReserved": "2025-07-16T15:11:01.684Z",
"dateUpdated": "2025-09-12T13:58:21.007Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-7635 (GCVE-0-2025-7635)
Vulnerability from cvelistv5 – Published: 2025-09-09 20:08 – Updated: 2025-09-12 13:56
VLAI
EPSS
VEX
Title
Calix GigaCenter ONT - Unauthenticated Telnet
Summary
Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 13:42 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
Fluid Attacks
CNA
References
3 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/sal | third-party-advisory |
| https://www.calix.com | productrelated |
| https://revers3everything.com/calix-case-five-0-d… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Calix | GigaCenter ONT |
Affected:
844E
Affected: 844G Affected: 844GE Affected: 854GE cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-7635",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T13:42:42.694051Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T13:42:48.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://fluidattacks.com/advisories/sal"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Quantenna SoC"
],
"product": "GigaCenter ONT",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "844E"
},
{
"status": "affected",
"version": "844G"
},
{
"status": "affected",
"version": "844GE"
},
{
"status": "affected",
"version": "854GE"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.\u003cp\u003eThis issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.\u003c/p\u003e"
}
],
"value": "Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE."
}
],
"impacts": [
{
"capecId": "CAPEC-114",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-114 Authentication Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-12T13:56:22.271Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/sal"
},
{
"tags": [
"product",
"related"
],
"url": "https://www.calix.com"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://revers3everything.com/calix-case-five-0-days-five-cves/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Calix GigaCenter ONT - Unauthenticated Telnet",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2025-7635",
"datePublished": "2025-09-09T20:08:37.767Z",
"dateReserved": "2025-07-14T12:49:39.283Z",
"dateUpdated": "2025-09-12T13:56:22.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-53914 (GCVE-0-2025-53914)
Vulnerability from cvelistv5 – Published: 2025-09-09 19:59 – Updated: 2025-09-12 13:55
VLAI
EPSS
VEX
Title
Calix GigaCenter ONT (Broadcom SoC) - Excessive Privileges
Summary
Excessive Privileges vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 20:19 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
Fluid Attacks
CNA
References
3 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/sheivi | third-party-advisory |
| https://www.calix.com | productrelated |
| https://revers3everything.com/calix-case-five-0-d… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Calix | GigaCenter ONT |
Affected:
844E
(custom)
Affected: 844G (custom) Affected: 844GE (custom) Affected: 854GE (custom) Affected: 812G (custom) Affected: 813G (custom) Affected: 818G (custom) cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:812g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:813g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:818g:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53914",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T20:19:13.956112Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T20:19:24.548Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Broadcom SoC"
],
"product": "GigaCenter ONT",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "844E",
"versionType": "custom"
},
{
"status": "affected",
"version": "844G",
"versionType": "custom"
},
{
"status": "affected",
"version": "844GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "854GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "812G",
"versionType": "custom"
},
{
"status": "affected",
"version": "813G",
"versionType": "custom"
},
{
"status": "affected",
"version": "818G",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:812g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:813g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:818g:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Excessive Privileges\u0026nbsp;vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.\u003cp\u003eThis issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G.\u003c/p\u003e"
}
],
"value": "Excessive Privileges\u00a0vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-12T13:55:32.373Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/sheivi"
},
{
"tags": [
"product",
"related"
],
"url": "https://www.calix.com"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://revers3everything.com/calix-case-five-0-days-five-cves/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Calix GigaCenter ONT (Broadcom SoC) - Excessive Privileges",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2025-53914",
"datePublished": "2025-09-09T19:59:27.381Z",
"dateReserved": "2025-07-11T22:32:54.176Z",
"dateUpdated": "2025-09-12T13:55:32.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-53913 (GCVE-0-2025-53913)
Vulnerability from cvelistv5 – Published: 2025-09-09 19:54 – Updated: 2025-09-12 13:54
VLAI
EPSS
VEX
Title
Calix GigaCenter ONT (Quantenna SoC) - Excessive Privileges
Summary
Excessive Privileges vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-10 20:16 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
Fluid Attacks
CNA
References
3 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/advisories/forty | third-party-advisory |
| https://www.calix.com | productrelated |
| https://revers3everything.com/calix-case-five-0-d… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Calix | GigaCenter ONT |
Affected:
844E
(custom)
Affected: 844G (custom) Affected: 844GE (custom) Affected: 854GE (custom) Affected: 812G (custom) Affected: 813G (custom) Affected: 818G (custom) cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:812g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:813g:*:*:*:*:*:*:* cpe:2.3:a:calix:gigacenter_ont:818g:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-53913",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T20:16:27.480729Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-10T20:16:37.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Quantenna SoC"
],
"product": "GigaCenter ONT",
"vendor": "Calix",
"versions": [
{
"status": "affected",
"version": "844E",
"versionType": "custom"
},
{
"status": "affected",
"version": "844G",
"versionType": "custom"
},
{
"status": "affected",
"version": "844GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "854GE",
"versionType": "custom"
},
{
"status": "affected",
"version": "812G",
"versionType": "custom"
},
{
"status": "affected",
"version": "813G",
"versionType": "custom"
},
{
"status": "affected",
"version": "818G",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844e:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:844ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:854ge:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:812g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:813g:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:calix:gigacenter_ont:818g:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Excessive Privileges vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows Privilege Abuse.\u003cp\u003eThis issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G.\u003c/p\u003e"
}
],
"value": "Excessive Privileges vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-12T13:54:40.859Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/advisories/forty"
},
{
"tags": [
"product",
"related"
],
"url": "https://www.calix.com"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://revers3everything.com/calix-case-five-0-days-five-cves/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Calix GigaCenter ONT (Quantenna SoC) - Excessive Privileges",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2025-53913",
"datePublished": "2025-09-09T19:54:01.838Z",
"dateReserved": "2025-07-11T22:32:54.176Z",
"dateUpdated": "2025-09-12T13:54:40.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}