CVE-2018-10562
Dasan GPON Routers Command Injection Vulnerability
Description
CVE-2018-10562 is a command injection vulnerability in Dasan GPON home routers that allows remote attackers to execute arbitrary operating system commands through the dest_host parameter. This vulnerability is frequently exploited in combination with CVE-2018-10561, an authentication bypass flaw in the same devices. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 97.5% (99.9th percentile), this is one of the most actively exploited IoT vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dasannetworks | gpon router firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/107053(Broken Link, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/44576/(Exploit, Third Party Advisory, VDB Entry)
- https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/(Exploit, Technical Description, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10562(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS command injection occurs when an application constructs system commands using unsanitized user input, allowing attackers to inject and execute arbitrary commands. In CVE-2018-10562, the Dasan GPON router passes the dest_host parameter directly to a system command without sanitization, enabling remote command execution. For more details, see CWE-78.
Impact Analysis
Successful exploitation grants complete control over affected Dasan GPON routers, allowing attackers to intercept all network traffic, redirect DNS queries, install persistent malware, and enroll the device in botnets. Since these routers serve as the internet gateway for homes and small businesses, their compromise affects all devices on the local network. Attackers frequently use compromised GPON routers for large-scale DDoS attacks, cryptocurrency mining, and as proxy nodes for malicious traffic. The combination with the authentication bypass vulnerability (CVE-2018-10561) means the entire attack can be performed without any credentials.
Exploit Maturity
CVE-2018-10562 was added to CISA's KEV catalog on March 31, 2022, confirming active exploitation. The EPSS score of 97.5% (99.9th percentile) reflects extremely widespread exploitation. Multiple IoT botnets including Mirai variants, Muhstik, and Hajime actively scan for and exploit this vulnerability. Exploitation is trivial, requiring only a simple HTTP request with injected shell commands in the dest_host parameter. Automated exploitation tools and scanning scripts are widely available and actively used at internet scale.
Remediation
- Replace affected Dasan GPON routers with supported devices that receive security updates, as these devices are end-of-life and unlikely to receive patches. This is the primary recommended action.
- If replacement is not immediately possible, disable remote management access on the router to prevent exploitation from the internet.
- Contact your internet service provider (ISP) to request a firmware update or replacement device if the GPON router was provided by the ISP.
- Place the GPON router behind a separate firewall device that filters inbound traffic to the router's management interface.
- Monitor network traffic for signs of botnet activity, including unusual outbound connections, DNS anomalies, and unexplained bandwidth consumption.
Technical Details
The vulnerability exists in the diagnostic functionality of Dasan GPON routers, accessible through the web interface at the /GponForm/diag_Form endpoint. When a user submits a diagnostic request, the dest_host parameter is passed directly to a ping command on the underlying Linux operating system without any input sanitization. An attacker can inject shell metacharacters (such as semicolons or backticks) followed by arbitrary commands into the dest_host parameter. When combined with CVE-2018-10561 (which bypasses authentication by appending ?images/ to any URL), the entire attack can be performed unauthenticated. The commands execute with root privileges on the router's embedded Linux system, providing complete device control.
Frequently Asked Questions
What is CVE-2018-10562?
CVE-2018-10562 is a command injection vulnerability in Dasan GPON home routers that allows remote attackers to execute arbitrary commands through the dest_host parameter in the diagnostic function. It is typically exploited together with CVE-2018-10561, an authentication bypass vulnerability.
What are GPON routers?
GPON (Gigabit Passive Optical Network) routers are fiber-optic network devices commonly deployed by internet service providers to deliver broadband internet to residential and small business customers. Dasan GPON routers were widely deployed across multiple ISPs globally.
Why is this vulnerability so heavily exploited?
The combination of trivial exploitation (a single HTTP request), authentication bypass (CVE-2018-10561), massive deployment numbers, and the likelihood of devices remaining unpatched makes this an ideal target for IoT botnets. Millions of GPON routers were deployed worldwide, many of which remain connected and vulnerable.
How can I check if my router is a vulnerable GPON device?
Check your router's model information in the web administration interface or on the device label. If it is a Dasan/Zhone GPON router, it is likely affected. Contact your ISP for information about your specific device model and available updates.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.