CVE-2018-10562
KEVRansomware UseDasan GPON Routers Command Injection Vulnerability
Description
Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublishedMay 4, 2018
Last modifiedJun 17, 2026
Added to KEVMar 31, 2022
Remediation dueApr 21, 2022
References
- securityfocus.com/bid/107053Broken LinkThird Party Advisory
- exploit-db.com/exploits/44576/ExploitThird Party Advisory
- vpnmentor.com/blog/critical-vulnerability-gpon-router/ExploitTechnical Description
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10562US Government Resource
0 recent articles mention this CVE
99
Risk assessment · Critical
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1650 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 99.9% · top 1% of all CVEs
- Weakness
- CWE-78
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
Recommended actions
- 1.The impacted product is end-of-life and should be disconnected if still in use.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.