CVE-2018-10561

dasannetworks gpon router firmware

Published 4 May 2018 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 31 Mar 2022, with a remediation deadline of 21 Apr 2022 for US federal agencies.

Required action: The impacted product is end-of-life and should be disconnected if still in use.

Description

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

References

www.securityfocus.com/bid/107053 · Broken Link, Third Party Advisory, VDB Entry
www.exploit-db.com/exploits/44576/ · Exploit, Third Party Advisory, VDB Entry
www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ · Exploit, Technical Description, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10561 · US Government Resource