CVE-2018-10561
Dasan GPON Routers Authentication Bypass Vulnerability
Description
CVE-2018-10561 is an authentication bypass vulnerability in Dasan GPON home routers that allows remote attackers to bypass the login mechanism by appending a specific string to URLs. This vulnerability is typically exploited in combination with CVE-2018-10562, a command injection flaw, to achieve unauthenticated remote code execution. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming widespread active exploitation. With an EPSS score of 97.0% (99.8th percentile), this is one of the most heavily exploited router vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dasannetworks | gpon router firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/107053(Broken Link, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/44576/(Exploit, Third Party Advisory, VDB Entry)
- https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/(Exploit, Technical Description, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10561(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
Improper authentication occurs when an application does not properly verify user identity before granting access to protected resources. In CVE-2018-10561, the Dasan GPON router's web server can be tricked into bypassing authentication checks by appending ?images/ to the URL, granting unauthenticated access to the entire administrative interface. For more details, see CWE-287.
Impact Analysis
The authentication bypass grants any remote attacker full administrative access to the GPON router's management interface without credentials. This alone allows modification of all router settings, DNS configuration, Wi-Fi credentials, and network configurations. When combined with CVE-2018-10562 (command injection), the pair provides complete unauthenticated remote code execution on the router. The broad deployment of GPON routers by ISPs worldwide means that millions of devices were potentially exposed, creating a massive attack surface for botnet recruitment, traffic interception, and network-level attacks against all connected devices.
Exploit Maturity
CVE-2018-10561 was added to CISA's KEV catalog on March 31, 2022. The EPSS score of 97.0% (99.8th percentile) confirms extremely widespread exploitation. The authentication bypass is trivially simple, requiring only the addition of ?images/ to any URL on the router's web interface. This simplicity has led to its incorporation into virtually every IoT botnet that targets GPON routers. Mass scanning and exploitation occurs continuously at internet scale, with millions of exploitation attempts recorded daily.
Remediation
- Replace affected Dasan GPON routers with current, supported devices from reputable manufacturers that receive regular security updates.
- If immediate replacement is not possible, ensure the router's web management interface is not accessible from the internet by disabling remote management.
- Request a device replacement or firmware update from your internet service provider if the router was ISP-provided equipment.
- Deploy a secondary firewall or security gateway in front of the GPON router to filter malicious traffic.
- Regularly monitor connected devices for unusual behavior that could indicate the router has been compromised.
Technical Details
The authentication bypass in Dasan GPON routers exploits a flaw in the web server's URL routing and authentication logic. The router's web server uses a simple URL-based rule to determine which requests require authentication. By appending the string ?images/ to any URL, the authentication check is bypassed because the server interprets the request as accessing a static resource directory that does not require authentication. This means that any protected page, including the administrative configuration interface, can be accessed without providing valid credentials simply by adding ?images/ to the URL. The flaw demonstrates a fundamental architectural weakness in the router's web server authentication design.
Frequently Asked Questions
What is CVE-2018-10561?
CVE-2018-10561 is an authentication bypass vulnerability in Dasan GPON routers. By appending ?images/ to any URL on the router's web interface, an attacker can bypass the authentication mechanism and access the administrative interface without credentials.
How is this related to CVE-2018-10562?
CVE-2018-10561 (authentication bypass) and CVE-2018-10562 (command injection) are companion vulnerabilities that are almost always exploited together. The authentication bypass provides access without credentials, and the command injection allows executing arbitrary commands. Together, they enable unauthenticated remote code execution.
How many devices are affected?
Millions of Dasan GPON routers were deployed worldwide by various internet service providers. The exact number of vulnerable devices is difficult to determine, but internet-wide scans have consistently identified hundreds of thousands of exposed devices.
Is my home network at risk?
If your internet router is a Dasan/Zhone GPON device, it is likely vulnerable. Check your router's model information and contact your ISP for a replacement or update. Even if your router is not directly exposed to the internet (which ISP-provided routers typically are), the vulnerability should be addressed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.