Actively exploited · Published May 4, 2018 · Assigned by mitre
CVE-2018-10562
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity OS command injection in Gigabit Passive Optical Network (GPON) Routers from Dasan. Attackers are actively exploiting it in the wild (listed by CISA on March 31, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by Apr 21, 2022.
Official description
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- 107053 vdb-entry, x_refsource_BID
- 44576 exploit, x_refsource_EXPLOIT-DB
- https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10562 government-resource