CVEvulnerability

CVE-2018-10561

9.8 CRITICAL Known exploited Published 2018-05-04 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Dasan GPON Routers Authentication Bypass Vulnerability — Dasan Gigabit Passive Optical Network (GPON) Routers

Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.

Added to KEV
2022-03-31
Remediation due
2022-04-21
Ransomware use
Unknown
Required action
The impacted product is end-of-life and should be disconnected if still in use.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-10561
Status
Analyzed
Published
2018-05-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287

Description

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

Affected configurations

• dasannetworks gpon router firmware

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References