Actively exploited in the wild

Dasan GPON Routers Command Injection Vulnerability

Dasan - Gigabit Passive Optical Network (GPON) Routers · Listed in the CISA KEV since 2022-03-31. This indicates confirmed attacks in production environments.

Required action: The impacted product is end-of-life and should be disconnected if still in use.

CVE-2018-10562

CriticalCVSS 9.8KEV

Published: 04/05/2018(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user, it's simple to execute commands and retrieve their output.

Risk Assessment

This vulnerability enables remote command execution on the router, potentially leading to full control of the device and network traffic.

Recommendation

Update Dasan GPON router firmware to the latest version. If updating is not possible, restrict access to the management interface from external networks.

Other vulnerabilities in Dasan GPON router

CVE-2018-10561CriticalActively exploited
An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

Original NVD description (English source)

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.