A critical Calix GigaSpire flaw lets an unauthenticated internet caller create persistent port-forwarding rules to devices inside a home network. No vendor patch was available at disclosure.