{"id":"CVE-2018-10561","kind":"vulnerability","aliases":["CVE-2018-10561"],"related":[],"title":"Dasan Gigabit Passive Optical Network (GPON) Routers: Dasan GPON Routers Authentication Bypass Vulnerability","description":"An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending \"?images\" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.","summary":"Dasan GPON routers contain an authentication bypass that lets an attacker skip login on the device. Combined with CVE-2018-10562, it allows remote code execution on the router.","severity":"critical","cvss":9.8,"epss":0.92818,"exploited":true,"exploited_at":"2022-03-31T00:00:00+00:00","products":[{"name":"Dasan Gigabit Passive Optical Network (GPON) Routers","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dasan","exploited","gpon","infrastructure","isp-equipment","routers"],"not_affected_if":["device-not-dasan-gpon","product-already-removed"],"how_to_check":null,"fix":"Disconnect the affected Dasan GPON router if it is still in use, since the product is end-of-life and no patch is named in the sources.\nReplace it with a supported device.","status":"open","published_at":"2018-05-04T03:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:19:40+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:19:40Z","model":"claude-haiku-5-5","output":{"fix":"Disconnect the affected Dasan GPON router if it is still in use, since the product is end-of-life and no patch is named in the sources.\nReplace it with a supported device.","reach":"internet","impact":"high","summary":"Dasan GPON routers contain an authentication bypass that lets an attacker skip login on the device. Combined with CVE-2018-10562, it allows remote code execution on the router.","category":"infrastructure","who_cares":["dasan","gpon","isp-equipment","routers"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker bypasses login and runs code on the router remotely.","analyst_note":"Confirm the affected models and firmware versions and whether any vendor fix exists, using the CISA KEV entry for CVE-2018-10561 and CVE-2018-10562 (cisa.gov/known-exploited-vulnerabilities-catalog).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["device-not-dasan-gpon","product-already-removed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000487,"input_tokens":2883,"output_tokens":397,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-10561':16A,19A '-10562':55B '-2018':15A,18A,54B '/gponform/diag_form':99C '/menu.html':96C 'allow':57B 'append':81C 'attack':45B 'authent':11A,40B,78C,91C 'bypass':12A,41B,77C 'code':59B 'combin':51B 'contain':38B 'cve':14A,17A,53B 'dasan':1A,8A,20A,27B,35B,69C 'demonstr':93C 'devic':50B,88C,107C 'discov':67C 'equip':33B 'execut':60B 'exploit':28B 'gigabit':2A,21A 'gpon':6A,9A,25A,29B,36B,70C 'home':71C 'imag':82C,97C,100C 'infrastructur':30B 'isp':32B 'isp-equip':31B 'issu':65C 'let':43B 'login':47B 'manag':105C 'network':5A,24A 'one':102C 'optic':4A 'optical':23A 'passiv':3A 'passive':22A 'possibl':75C 'remot':58B 'requir':90C 'router':7A,10A,34B,37B,63B,72C 'routers':26A 'simpli':79C 'skip':46B 'uri':101C 'url':85C 'vulner':13A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-05-04T03:29:00+00:00","kev":{"dateAdded":"2022-03-31","dueDate":"2022-04-21","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-10561","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-10561","severity":null,"published_at":"2022-03-31T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2018-10561","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-10561","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-10561","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10561","severity":null,"published_at":"2018-05-04T03:29:00+00:00","modified_at":"2026-06-17T01:34:10+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}