---
id: "CVE-2018-10561"
kind: "vulnerability"
aliases: ["CVE-2018-10561"]
title: "Dasan Gigabit Passive Optical Network (GPON) Routers: Dasan GPON Routers Authentication Bypass Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.92818
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Dasan Gigabit Passive Optical Network (GPON) Routers", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["dasan", "exploited", "gpon", "infrastructure", "isp-equipment", "routers"]
not_affected_if: ["device-not-dasan-gpon", "product-already-removed"]
published_at: "2018-05-04T03:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-10561", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-10561", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10561", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Dasan Gigabit Passive Optical Network (GPON) Routers: Dasan GPON Routers Authentication Bypass Vulnerability

Dasan GPON routers contain an authentication bypass that lets an attacker skip login on the device. Combined with CVE-2018-10562, it allows remote code execution on the router.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Dasan Gigabit Passive Optical Network (GPON) Routers affected ? fixed ?

## Fix

Disconnect the affected Dasan GPON router if it is still in use, since the product is end-of-life and no patch is named in the sources.
Replace it with a supported device.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-10561
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-10561
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-10561

## From the sources

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_