CVE-2018-10561

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

The impacted product is end-of-life and should be disconnected if still in use.

Added 2022-03-31Remediation due 2022-04-21

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

9.8

CVSS

92.9%

EPSS (exploit prob.)

100th

EPSS percentile

2018-05-04

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

Affected products

Vendor	Product	Affected versions
dasannetworks	gpon_router_firmware	all versions
dasannetworks	gpon_router	all versions

Check a specific version with /api/v1/cve/match.

References

http://www.securityfocus.com/bid/107053
https://www.exploit-db.com/exploits/44576/
https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/
http://www.securityfocus.com/bid/107053
https://www.exploit-db.com/exploits/44576/
https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10561

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-10561