CVE-2018-10562

🗓️ 04 May 2018 03:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 1314 Views🌐 WEB

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI

Reporter	Title	Published	Views	Family All 40
GithubExploit	Exploit for OS Command Injection in Dasannetworks Gpon_Router_Firmware	6 Jun 201809:43	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Dasannetworks Gpon_Router_Firmware	15 May 201817:31	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Dasannetworks Gpon_Router_Firmware	17 May 201822:03	–	githubexploit
0day.today	GPON Routers - Authentication Bypass / Command Injection Exploit	3 May 201800:00	–	zdt
ATTACKERKB	CVE-2018-10562	4 May 201800:00	–	attackerkb
BDU FSTEC	The vulnerability of the Dasan GPON router’s microprogramming software, related to the lack of measures taken to clean data at the management level, allows attackers to perform arbitrary actions with administrator privileges.	29 Mar 201900:00	–	bdu_fstec
Broadcom	BSA-2018-604	8 May 201800:00	–	broadcom
Circl	CVE-2018-10562	10 May 201810:42	–	circl
CISA KEV Catalog	Dasan GPON Routers Authentication Bypass Vulnerability	31 Mar 202200:00	–	cisa_kev
CISA KEV Catalog	Dasan GPON Routers Command Injection Vulnerability	31 Mar 202200:00	–	cisa_kev

NVD

Node

dasannetworks gpon_router_firmwareMatch-

AND

dasannetworks gpon_routerMatch-

Source	Link
exploit-db	www.exploit-db.com/exploits/44576/
vpnmentor	www.vpnmentor.com/blog/critical-vulnerability-gpon-router/
securityfocus	www.securityfocus.com/bid/107053
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
dest_host	request body	GponForm/diag_Form?images/	Command injection via dest_host parameter in diag_Form affected by CVE-2018-10562.	CWE-78
diag_action	request body	GponForm/diag_Form?images/	Command injection via dest_host parameter in diag_Form affected by CVE-2018-10562.	CWE-78
wan_conlist	request body	GponForm/diag_Form?images/	Command injection via dest_host parameter in diag_Form affected by CVE-2018-10562.	CWE-78
ipv	request body	GponForm/diag_Form?images/	Command injection via dest_host parameter in diag_Form affected by CVE-2018-10562.	CWE-78
images	path	diag.html?images/	Used to retrieve command output after exploitation, part of the exploit flow.	CWE-78
images	query param	menu.html?images/	Bypass authentication path to access vulnerable endpoints, used in exploitation flow.	CWE-78
images	path	GponForm/diag_Form?images/	Alternative path naming for the diagnostic form used in the exploit to trigger command injection.	CWE-78

17 Jun 2026 01:34Current

9.8High risk

Vulners AI Score9.8

CVSS 27.5

CVSS 3.19.8

EPSS0.9995

SSVC