Actively exploited · Published May 4, 2018 · Assigned by mitre
CVE-2018-10561
Critical 9.8 Exploited
In plain English
A critical-severity improper authentication in Gigabit Passive Optical Network (GPON) Routers from Dasan. Attackers are actively exploiting it in the wild (listed by CISA on March 31, 2022). The chance it is exploited in the next 30 days is estimated at 92.8% (higher than 99.8% of all known vulnerabilities). The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by Apr 21, 2022.
Official description
An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- 107053 vdb-entry, x_refsource_BID
- 44576 exploit, x_refsource_EXPLOIT-DB
- https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10561 government-resource