Calix GigaCenter ONT - Unauthenticated Telnet

Description

The Calix GigaCenter ONT 844E, 844G, 844GE, and 854GE are affected by a vulnerability in their firmware design. During the boot process, after the Broadcom System-on-Chip (SoC) completes initialization, it enables the Quantenna SoC to boot. As part of this process, the Quantenna interface becomes active and exposes additional internal services. It has been discovered that the Telnet service is accessible via the Quantenna interface IP without requiring authentication. This exposure allows an attacker with access to the local network (LAN) to connect to the Telnet service and gain unauthorized, high-privilege access to the device.

Vulnerability

Steps to reproduce the vulnerability:

1. Run an Nmap scan on port 23 at [Quantenna interface IP address], using the following command: sudo nmap -n -Pn -p 23 [Quantenna interface IP address]

2. Next, start a Telnet session to address [Quantenna interface IP address].

3. When prompted for a username, enter "admin" or "root."

   • The system won't ask for a password because these two root users don't have a password set on the system.

   • This can be verified by checking the '/etc/shadow' file.

Evidence of Exploitation

Interface [Quantenna interface IP address] is discovered during the boot process of the Broadcom SoC:

Port scan of IP [Quantenna interface IP address]:

Unauthenticated root access to the Telnet service via the 'admin' user:

Telnet access + PSK leak:

Our security policy

We have reserved the ID CVE-2025-7635 to refer to this issue from now on.

Disclosure policy

System Information

• Calix GigaCenter ONT 844E, 844G, 844GE and 854GE.

• Firmware version 4.16L.05xponpatch2 (build timestamp 230328_1137)

References

• Vendor: https://www.calix.com

• Security: https://www.calix.com/security.html

Mitigation

This issue is resolved in the R12.2.13.4 patch available to authorised users. Subscribers with concerns about the security of the ONT servicing their premises should contact their BSP to push the update, as these devices are not licensed to consumers.  

Credits

The vulnerability was discovered by Danilo Erazo,  an independent security researcher.