PT-2018-2612 · Dasan · Dasan Gpon

Vpnmentor · Published 2018-05-03 · Updated 2026-02-16 · CVE-2018-10561

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dasan GPON home routers (affected versions not specified)

Description The issue is related to weaknesses in the authentication procedure of the Dasan GPON home routers. It allows a remote attacker to bypass authentication and gain full control over the device by appending "?images/" to any URL that requires authentication, such as "/menu.html?images/" or "/GponForm/diag FORM?images/". This enables the attacker to manage the device.

Recommendations For Dasan GPON home routers, as a temporary workaround, consider restricting access to URLs that require authentication until a patch is available. Avoid using URLs with the "?images/" parameter in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2019-01221

CVE-2018-10561

Affected Products

Dasan Gpon

References · 26

• 🔥 https://exploit-db.com/exploits/44576 · Exploit
• 🔥 https://vpnmentor.com/blog/critical-vulnerability-gpon-router · Exploit
• https://bdu.fstec.ru/vul/2019-01221 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-10561 · Security Note
• https://t.me/cybersecuritytechnologies/2358 · Telegram Post
• https://t.me/aptreports/15734 · Telegram Post
• https://t.me/cveNotify/141846 · Telegram Post
• https://t.me/aptreports/10732 · Telegram Post
• https://t.me/cvenotify/117653 · Telegram Post
• https://t.me/cvenotify/108377 · Telegram Post
• https://t.me/aptreports/18350 · Telegram Post
• https://t.me/aptreports/26051 · Telegram Post
• https://t.me/aptreports/25794 · Telegram Post
• https://t.me/aptreports/11253 · Telegram Post
• https://t.me/aptreports/18387 · Telegram Post