Introduction

Hi everyone, back in May I found decent vulnerablities in my router, today I can finally show everyone!

Both vulnerablities in this repo are authenticated Denial of Service vulnerablities!

I do not know the exact techial details of how or why these vulnerablities work, we never got a response from Calix (the vendor in this case) so yeaaa! fun!

this is also my first and second CVEs ever, 2 for 1 deal np.

CVE-2026-19745

CVE-2026-19745 is a Improper Resource Shutdown or Release DoS affecting my rotuer :)

https://nvd.nist.gov/vuln/detail/CVE-2026-19745

"A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave.cgi of the component Web Management Interface. Executing a manipulation of the argument sessionKey can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."

Explaination

VulDB has decided that the proper CWE is CWE-404 which kinda superised me because I was thinking of CWE-835 Sadly I do not have techical details on why this occured, but I can tell you I found these two CVEs by complete and utter accident.

Time-Line

May 30th: Vulnerablity found, initally I thought it was just some ratelimtiing until I tried to use the website on another computer, turns out it was not

May 31st: After mental prep I decided this was worth reporting even if I was wrong to begin with.

June 15th: I turnt 16, very important to the timeline clearly.

June 24th: Reported to VulnDB

June 26th: Calix (finally) got back to me which was unexpected, claim no vulnerablity existed but they were going to "patch" it next release ?? nice one, i also replied same day with video proof of my report being an actual vulnerablity, i recived no response after.

August 13th: CVE Assigned by VulDB.

Response

Calix said this was expected behavior from a timeout while the application awaits user-input, this could be very well the case but this should not have any effect on any other user.

alt text

Video

https://github.com/user-attachments/assets/6aa509d4-ee69-4ed6-a9bb-1324f77a7036

Calix is the god at communication

As the time line suggested, calix was not really any usefulness besides getting the CVE assigned due to the lack of communcation, as far as I am aware vuldb contacted calix and they never got a response themselfs.

I would love to show you the response they have given me, but I am not allowed to sadly :( Basically they just said they were unable to reproduce and they aren't gonna patch exepct the traceroot one (see below)

CVE-2026-19746

https://github.com/user-attachments/assets/62c1ae62-8d52-4e97-975c-3c14ee6d8c95

Explaination

I was looking at all the endpoints that the broweser interface exposes and I noticed traceroot.cmd which accepts a cancel operation. I thought to my self what would happen if I simply canceled a traceroot that did not exist.

I tried and it appeared the entire interface crashes, and everyone is logged out and past cookies and stuff are invalidated.

This is the one Calix is gonna patch, claiming there is no DoS but it triggers an "unexpected" codepath.

Ending

I would like to give a huge shoutout to VulDB's moderation and security team, they did an awesome job at reviewing my reports and taking it serious (unlike a certin someone in here) I'll be looking foward to submititng more reports in the future! :)

PS: I was really nervous when trying to submit this because this is the first time I've done something like this and I was very unsure if what I found was a vulnerablity or not, however I knew when I did tests on all of these vulnerablities on a seperate computer! Meaning my first computer acted like an attacker while a second computer was logged on, and the effects were seen on both computers!

I do believe VulDB's Analysis went too far here (arugably AI) but whatever, such as stating it as a "critical security flaw" when it really isn't.

Other things

During the time-line I also sent like 2 follow up emails and I got nothing expect errors from whatever email service they are using and I got ignored on the previous one.

alt text