VULNERABILITY INTELLIGENCE

CVE-2018-10561

CVSS score9.8 CRITICAL

EPSS probability92.82%

CISA KEVKnown exploited vulnerability

Published2018-05-04

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Dasan GPON Routers Authentication Bypass Vulnerability

Vendor / product: Dasan / Gigabit Passive Optical Network (GPON) Routers

Description

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

Weakness classification

CWE-287: Improper Authentication

Primary references

cve@mitre.org — Broken Link, Third Party Advisory, VDB Entry
cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
cve@mitre.org — Exploit, Technical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Technical Description, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource