{"id":"CVE-2018-10562","kind":"vulnerability","aliases":["CVE-2018-10562"],"related":[],"title":"Dasan Gigabit Passive Optical Network (GPON) Routers: Dasan GPON Routers Command Injection Vulnerability","description":"An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.","summary":"Dasan GPON routers contain an authentication bypass that, combined with CVE-2018-10561, lets an attacker run commands on the router. The attacker gets full control of the device and the network traffic that passes through it.","severity":"critical","cvss":9.8,"epss":0.99949,"exploited":true,"exploited_at":"2022-03-31T00:00:00+00:00","products":[{"name":"Dasan Gigabit Passive Optical Network (GPON) Routers","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dasan-gpon","exploited","infrastructure","isp-equipment","ransomware","routers"],"not_affected_if":["no-dasan-gpon-device"],"how_to_check":"Identify any Dasan GPON router in your network, including ISP-supplied or branch-office units; the sources do not give a command or setting to check the firmware version.","fix":"Disconnect the impacted Dasan GPON router if it is still in use, since the product is end-of-life and no patch is listed in the sources.","status":"open","published_at":"2018-05-04T03:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:19:40+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:19:40Z","model":"claude-haiku-5-5","output":{"fix":"Disconnect the impacted Dasan GPON router if it is still in use, since the product is end-of-life and no patch is listed in the sources.\nunknown","reach":"internet","impact":"high","summary":"Dasan GPON routers contain an authentication bypass that, combined with CVE-2018-10561, lets an attacker run commands on the router. The attacker gets full control of the device and the network traffic that passes through it.","category":"infrastructure","who_cares":["dasan-gpon","routers","isp-equipment"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs commands on the router and controls its traffic","analyst_note":"Find the affected firmware versions and any vendor or CISA advisory with a patch or workaround, starting from the KEV entry at cisa.gov and the EPSS API link in the sources.","how_to_check":"Identify any Dasan GPON router in your network, including ISP-supplied or branch-office units; the sources do not give a command or setting to check the firmware version.\nunknown","needs_analyst":true,"not_affected_if":["no-dasan-gpon-device"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000499,"input_tokens":2885,"output_tokens":422,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-10561':49B '-10562':16A,19A '-2018':15A,18A,48B '/diag.html':118C '/tmp':107C 'action':93C 'attack':52B,59B 'authent':42B 'bypass':43B 'combin':45B 'command':11A,54B,81C,125C 'contain':40B 'control':62B 'cve':14A,17A,47B 'dasan':1A,8A,20A,28B,37B,77C 'dasan-gpon':27B 'dest':87C 'devic':65B 'diag':92C 'discov':75C 'equip':34B 'execut':124C 'exploit':30B 'full':61B 'get':60B 'gigabit':2A,21A 'gpon':6A,9A,25A,29B,38B,78C 'gponform/diag_form':98C 'home':79C 'host':88C 'infrastructur':31B 'inject':12A,82C 'isp':33B 'isp-equip':32B 'issu':73C 'let':50B 'network':5A,24A,68B 'occur':84C 'optic':4A 'optical':23A 'output':129C 'paramet':89C 'pass':71B 'passiv':3A 'passive':22A 'ping':94C,104C 'quit':121C 'ransomwar':35B 'request':95C 'result':105C 'retriev':127C 'revisit':117C 'router':7A,10A,36B,39B,57B,80C,102C 'routers':26A 'run':53B 'save':103C 'simpl':122C 'traffic':69B 'transmit':109C 'uri':99C 'user':113C,116C 'via':85C 'vulner':13A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-05-04T03:29:00+00:00","kev":{"dateAdded":"2022-03-31","dueDate":"2022-04-21","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-10562","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-10562","severity":null,"published_at":"2022-03-31T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2018-10562","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-10562","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-10562","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10562","severity":null,"published_at":"2018-05-04T03:29:00+00:00","modified_at":"2026-06-17T01:34:10+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}