CVE-2018-10561

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2018-05-04

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2022-03-31, action due 2022-04-21: The impacted product is end-of-life and should be disconnected if still in use.

Weaknesses

CWE-287

Affected products

• Gpon Router Firmware (Dasannetworks)

References

• http://www.securityfocus.com/bid/107053
• https://www.exploit-db.com/exploits/44576/
• https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10561